GAQM CFA-001 Exam - Topic 4 Question 105 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 105
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: B

by Lemuel at Mar 19, 2025, 03:21 AM

Limited Time Offer

25%

Off

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Sylvie

4 months ago

B seems unnecessary, who cares if it's on or off?

upvoted 0 times

...

Luz

4 months ago

I think D is a bad idea, you shouldn't turn on the computer!

upvoted 0 times

...

Bobbye

4 months ago

C is definitely a no-go, you could lose data that way.

upvoted 0 times

...

Joaquin

4 months ago

Wait, removing the power cable? That sounds risky!

upvoted 0 times

...

Joesph

5 months ago

A is definitely important for evidence tracking.

upvoted 0 times

...

Micaela

5 months ago

I practiced a question similar to D, and I think turning on the computer to extract logs is generally a bad idea for preserving evidence.

upvoted 0 times

...

Mohammad

5 months ago

C sounds risky to me. Removing the power cable could lead to data loss, right?

upvoted 0 times

...

Gayla

5 months ago

I’m not sure about B; verifying the monitor's state seems important, but is it really necessary?

upvoted 0 times

...

Janae

5 months ago

I remember discussing the importance of documenting actions, so I think A is correct.

upvoted 0 times

...

Emily

6 months ago

I think the key here is to avoid making any changes to the system or peripherals. The correct approach is to document everything as-is without powering on or modifying anything.

upvoted 0 times

...

Bernadine

6 months ago

Okay, I've got this. The incorrect statement is D - turning on the computer and extracting Windows event viewer logs would actually alter the digital evidence, so that's not the right approach.

upvoted 0 times

...

Carri

6 months ago

Hmm, I'm a bit unsure about this one. I'll need to carefully review the options and think through the best practices for handling digital evidence.

upvoted 0 times

...

Dana

6 months ago

This question seems straightforward, but I want to make sure I understand the key points about preserving digital evidence correctly.

upvoted 0 times

...

Barrett

11 months ago

Wow, these options are like a digital forensics minefield. Better tread carefully or you might end up with a mess on your hands!

upvoted 0 times

Carma

10 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Lorean

10 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Gladys

10 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Mona

10 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Lisandra

10 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Antonio

11 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

Xochitl

12 months ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

Angella

11 months ago

Option C is incorrect. You should never remove the power cable, as that could potentially cause data loss or corruption. The power state should be documented, but the cable should remain as is.

upvoted 0 times

...

Ernest

11 months ago

D) Turn on the computer and extract Windows event viewer log files

upvoted 0 times

...

Stefany

11 months ago

C) Remove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

upvoted 0 times

...

Valentine

11 months ago

B) Verily if the monitor is in on, off, or in sleep mode

upvoted 0 times

...

Annita

11 months ago

A) Document the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

upvoted 0 times

...

France

12 months ago

Haha, turning on the computer? That's like asking a detective to set a crime scene on fire before investigating. Not the brightest idea!

upvoted 0 times

...

Theresia

12 months ago

I agree with Tyra. Turning on the computer could overwrite or alter important evidence, making it unusable for the investigation.

upvoted 0 times

...

Tyra

1 year ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

Marjory

10 months ago

Option D is incorrect. You should never turn on a computer during a digital forensics investigation, as it can potentially modify or destroy evidence.

upvoted 0 times

...