GAQM Exam CFA-001 Topic 4 Question 105 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 105
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: B

by Lemuel at Mar 19, 2025, 03:21 AM

Limited Time Offer

25%

Off

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Xochitl

9 days ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

...

France

10 days ago

Haha, turning on the computer? That's like asking a detective to set a crime scene on fire before investigating. Not the brightest idea!

upvoted 0 times

...

Theresia

11 days ago

I agree with Tyra. Turning on the computer could overwrite or alter important evidence, making it unusable for the investigation.

upvoted 0 times

...

Tyra

17 days ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

...