ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 312-49v10 All Questions

View all questions & answers for the 312-49v10 exam
Go to Exam

Exam 312-49v10 topic 1 question 95 discussion

Actual exam question from ECCouncil's 312-49v10
Question #: 95
Topic #: 1
[All 312-49v10 Questions]

A state department site was recently attacked and all the servers had their disks erased. The incident response team sealed the area and commenced investigation. During evidence collection they came across a zip disks that did not have the standard labeling on it. The incident team ran the disk on an isolated system and found that the system disk was accidentally erased. They decided to call in the FBI for further investigation. Meanwhile, they short listed possible suspects including three summer interns. Where did the incident team go wrong?

  • A. They examined the actual evidence on an unrelated system
  • B. They attempted to implicate personnel without proof
  • C. They tampered with evidence by using it
  • D. They called in the FBI without correlating with the fingerprint data
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by 044f354 at March 10, 2025, 2:29 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
044f354
1 month, 1 week ago
Selected Answer: A
Answer: (A) They examined the actual evidence on an unrelated system Explanation: (A) They examined the actual evidence on an unrelated system ✅ Violates forensic principles; risks contamination or alteration of evidence. (B) They attempted to implicate personnel without proof ❌ No evidence in the scenario suggests premature accusations were made. (C) They tampered with evidence by using it ❌ Running the disk on an isolated system is not tampering but improper handling. (D) They called in the FBI without correlating with the fingerprint data ❌ Calling the FBI is appropriate for major incidents, regardless of fingerprint data. ----- If you agree, please UPVOTE. Each time you upvote someone with contributor access (like me) your vote is added to the Community Vote Distribution, which helps the entire community.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago