GAQM Exam CFA-001 Topic 4 Question 105 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 105
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: B

by Lemuel at Mar 19, 2025, 03:21 AM

Limited Time Offer

25%

Off

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Barrett

1 months ago

Wow, these options are like a digital forensics minefield. Better tread carefully or you might end up with a mess on your hands!

upvoted 0 times

Carma

17 hours ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Lorean

6 days ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Gladys

8 days ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Mona

14 days ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Lisandra

15 days ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Antonio

27 days ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Xochitl

2 months ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

Angella

21 days ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

...

Ernest

23 days ago

D) Turn on the computer and extract Windows event viewer log files

upvoted 0 times

...

Stefany

25 days ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Valentine

27 days ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Annita

1 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

France

2 months ago

Haha, turning on the computer? That's like asking a detective to set a crime scene on fire before investigating. Not the brightest idea!

upvoted 0 times

...

Theresia

2 months ago

I agree with Tyra. Turning on the computer could overwrite or alter important evidence, making it unusable for the investigation.

upvoted 0 times

...

Tyra

2 months ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

Marjory

17 days ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

...