Discuss GAQM CFA-001 Exam Topic 4 Question 122

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Suggested Answer: D

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

24 comments · newest first

Cristen 3 days ago

But B is important too. You need to know the power state first.

Macy 8 days ago

I feel like C is also risky. Removing power can corrupt files.

Katina 13 days ago

Agreed, Tom. Once it's on, you lose original data.

Teddy 19 days ago

I think D is definitely incorrect. Turning on the computer can alter evidence.

Jeffrey 24 days ago

Overall, D stands out as the most problematic. Always avoid powering on!

Carmelina 29 days ago

B is important too. Knowing the power state helps in handling the device properly.

India 1 month ago

I feel like A is crucial. Documenting actions is key to preserving evidence.

Rosendo 1 month ago

C seems risky too. Removing the power cable can cause data loss.

Paola 1 month ago

Agreed! Once you power it up, you risk changing the data.

Teddy 2 months ago

I think D is definitely incorrect. Turning on the computer can alter evidence.

Venita 2 months ago

Wait, are we really supposed to turn on the computer? That sounds risky!

Lourdes 2 months ago

Totally agree with you, Edgar!

Ilene 2 months ago

B seems a bit weird, why does it matter if the monitor is on or off?

Edgar 2 months ago

I think D is a big no-no! Turning on the computer can change evidence.

Hobert 3 months ago

A is definitely important for documentation.

Terrilyn 3 months ago

Are we sure about C? Removing the power cable sounds risky.

Scot 3 months ago

Wow, I can't believe people would actually turn on the computer!

Adell 3 months ago

B seems a bit off, but I guess it matters for context.

Jani 3 months ago

I think D is a big no-no! You shouldn't turn on the computer.

Yuonne 3 months ago

A is definitely important for evidence tracking.

Herminia 4 months ago

I’m a bit confused about the power states; I thought we should always check the power state first before doing anything, which makes me question A.

Freeman 4 months ago

I feel like I've seen a question similar to this before, and I think removing the power cable can be risky, so C might be the wrong choice.

Cathern 4 months ago

I'm not entirely sure, but I remember something about documenting the state of the monitor being important, so maybe B is correct?

Talia 5 months ago

I think option D is definitely incorrect because turning on the computer could alter the evidence.

GAQM CFA-001 Exam - Topic 4 Question 122 Discussion