Eccouncil Exam 212-82 Topic 10 Question 11 Discussion

Actual exam question for Eccouncil's 212-82 exam

Question #: 11
Topic #: 10

You've been called in as a computer forensics investigator to handle a case involving a missing company laptop from the accounting department, which contained sensitive financial dat

a. The company suspects a potential data breach and wants to recover any evidence from the missing device. What is your MOST important initial action regarding the digital evidence?

ATurn on the laptop (if found) and search for deleted files.

BInterview company personnel to understand the missing laptop's usage.

CReport the incident to law enforcement immediately.

DSecure the scene where the laptop was last seen (if possible).

Show Suggested Answer

Suggested Answer: C

by Haydee at Feb 05, 2023, 09:33 PM

Limited Time Offer

25%

Off

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Josphine

1 months ago

Option C is tempting, but reporting to law enforcement should be a secondary step. First, we need to make sure the scene is secured and the digital evidence is preserved. Can't have the feds snapping pictures of an unsecured crime scene, can we?

upvoted 0 times

Lindsay

10 days ago

A) Turn on the laptop (if found) and search for deleted files.

upvoted 0 times

...

Gearldine

1 months ago

Haha, option A sounds like something a computer novice would do. Turning on the laptop and searching for deleted files? That's like trying to bake a cake with a sledgehammer!

upvoted 0 times

Major

11 hours ago

User 2: Yeah, we need to secure the scene first.

upvoted 0 times

...

Cruz

3 days ago

User 1: I agree, option A seems a bit reckless.

upvoted 0 times

...

Lenna

1 months ago

Hmm, I'm tempted to go with option B and interview the personnel. Understanding the laptop's usage history might give us some clues. But you're right, securing the scene should be the top priority.

upvoted 0 times

Kerry

6 days ago

B) Interview company personnel to understand the missing laptop's usage.

upvoted 0 times

...

Salley

11 days ago

D) Secure the scene where the laptop was last seen (if possible).

upvoted 0 times

...

Arlean

1 months ago

A) Turn on the laptop (if found) and search for deleted files.

upvoted 0 times

...

Bev

2 months ago

Option D is the way to go! Securing the scene is crucial to preserve any potential digital evidence. Rushing to turn on the laptop could wipe out critical data.

upvoted 0 times