Eccouncil 212-82 Exam - Topic 10 Question 11 Discussion

Actual exam question for Eccouncil's 212-82 exam

Question #: 11
Topic #: 10

You've been called in as a computer forensics investigator to handle a case involving a missing company laptop from the accounting department, which contained sensitive financial dat

a. The company suspects a potential data breach and wants to recover any evidence from the missing device. What is your MOST important initial action regarding the digital evidence?

ATurn on the laptop (if found) and search for deleted files.

BInterview company personnel to understand the missing laptop's usage.

CReport the incident to law enforcement immediately.

DSecure the scene where the laptop was last seen (if possible).

Show Suggested Answer

Suggested Answer: C

by Haydee at Feb 05, 2023, 09:33 PM

Limited Time Offer

25%

Off

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nina

5 months ago

Not sure interviewing will help much if the laptop is already gone.

upvoted 0 times

...

Vanesa

5 months ago

Wait, shouldn't we report it to the police right away?

upvoted 0 times

...

Cassie

6 months ago

Turning on the laptop? That sounds risky!

upvoted 0 times

...

Annelle

6 months ago

I think securing the scene is crucial too.

upvoted 0 times

...

Jennifer

6 months ago

Definitely need to interview personnel first!

upvoted 0 times

...

Bernardo

6 months ago

Reporting to law enforcement seems important, but I wonder if we should gather more information first. I guess it depends on the situation and urgency.

upvoted 0 times

...

Audry

6 months ago

I practiced a similar question, and I remember that turning on the laptop could risk altering evidence. So, I think we should avoid that at all costs.

upvoted 0 times

...

Vi

6 months ago

I'm not entirely sure, but I feel like interviewing personnel could give us insights into the laptop's usage. It might help us understand if it was stolen or misplaced.

upvoted 0 times

...

Vernell

6 months ago

I think the first step should be to secure the scene where the laptop was last seen. If I remember correctly, preserving the environment is crucial for any evidence.

upvoted 0 times

...

Mayra

6 months ago

You know, I think I'd start by creating a new column that extracts the hour and day of the year from the IOT DateTime column. That could help with the analysis part.

upvoted 0 times

...

Ah, I see what's going on now. The 'Automatic submission' setting in Firefox could be interfering with the Okta plugin's functionality. I'll make sure to test that out and see if it's the likely reason for the issue.

upvoted 0 times

...

Josphine

11 months ago

Option C is tempting, but reporting to law enforcement should be a secondary step. First, we need to make sure the scene is secured and the digital evidence is preserved. Can't have the feds snapping pictures of an unsecured crime scene, can we?

upvoted 0 times

Danica

10 months ago

B) Interview company personnel to understand the missing laptop's usage.

upvoted 0 times

...

Ligia

10 months ago

D) Secure the scene where the laptop was last seen (if possible).

upvoted 0 times

...

Lindsay

10 months ago

A) Turn on the laptop (if found) and search for deleted files.

upvoted 0 times

...

Gearldine

11 months ago

Haha, option A sounds like something a computer novice would do. Turning on the laptop and searching for deleted files? That's like trying to bake a cake with a sledgehammer!

upvoted 0 times

Ben

10 months ago

User 3: Definitely, we can't risk contaminating the evidence.

upvoted 0 times

...

Major

10 months ago

User 2: Yeah, we need to secure the scene first.

upvoted 0 times

...

Cruz

10 months ago

User 1: I agree, option A seems a bit reckless.

upvoted 0 times

...

Lenna

11 months ago

Hmm, I'm tempted to go with option B and interview the personnel. Understanding the laptop's usage history might give us some clues. But you're right, securing the scene should be the top priority.

upvoted 0 times

Kerry

10 months ago

B) Interview company personnel to understand the missing laptop's usage.

upvoted 0 times

...

Salley

10 months ago

D) Secure the scene where the laptop was last seen (if possible).

upvoted 0 times

...

Arlean

11 months ago

A) Turn on the laptop (if found) and search for deleted files.

upvoted 0 times

...

Bev

12 months ago

Option D is the way to go! Securing the scene is crucial to preserve any potential digital evidence. Rushing to turn on the laptop could wipe out critical data.

upvoted 0 times