GAQM CFA-001 Exam - Topic 4 Question 122 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 122
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: D

by Alyssa at May 12, 2026, 06:45 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

17 days ago

I think option D is definitely incorrect because turning on the computer could alter the evidence.

upvoted 0 times

...