Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

GAQM CFA-001 Exam - Topic 4 Question 122 Discussion

Actual exam question for GAQM's CFA-001 exam

Question #: 122
Topic #: 4

[All CFA-001 Questions]

Which of the following statements is incorrect when preserving digital evidence?

ADocument the actions and changes that you observe in the monitor, computer, printer, or in other peripherals

BVerily if the monitor is in on, off, or in sleep mode

CRemove the power cable depending on the power state of the computer i.e., in on. off, or in sleep mode

DTurn on the computer and extract Windows event viewer log files

Show Suggested Answer

Suggested Answer: D

by Alyssa at May 12, 2026, 06:45 AM

Limited Time Offer

25%

Off

Get Premium CFA-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jani

4 days ago

I think D is a big no-no! You shouldn't turn on the computer.

upvoted 0 times

...

Yuonne

10 days ago

A is definitely important for evidence tracking.

upvoted 0 times

...

Herminia

15 days ago

I’m a bit confused about the power states; I thought we should always check the power state first before doing anything, which makes me question A.

upvoted 0 times

...

Freeman

20 days ago

I feel like I've seen a question similar to this before, and I think removing the power cable can be risky, so C might be the wrong choice.

upvoted 0 times

...

Cathern

25 days ago

I'm not entirely sure, but I remember something about documenting the state of the monitor being important, so maybe B is correct?

upvoted 0 times

...

Talia

2 months ago

I think option D is definitely incorrect because turning on the computer could alter the evidence.

upvoted 0 times

...