GAQM Exam CFA-001 Topic 4 Question 105 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 105
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: B

by Lemuel at Mar 19, 2025, 03:21 AM

Limited Time Offer

25%

Off

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Barrett

3 months ago

Wow, these options are like a digital forensics minefield. Better tread carefully or you might end up with a mess on your hands!

upvoted 0 times

Carma

1 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Lorean

1 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Gladys

1 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Mona

2 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Lisandra

2 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Antonio

2 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Xochitl

3 months ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

Angella

2 months ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

...

Ernest

2 months ago

D) Turn on the computer and extract Windows event viewer log files

upvoted 0 times

...

Stefany

2 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Valentine

2 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Annita

2 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

France

3 months ago

Haha, turning on the computer? That's like asking a detective to set a crime scene on fire before investigating. Not the brightest idea!

upvoted 0 times

...

Theresia

3 months ago

I agree with Tyra. Turning on the computer could overwrite or alter important evidence, making it unusable for the investigation.

upvoted 0 times

...

Tyra

3 months ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

Marjory

2 months ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

...