Certified Computer Examiner (CCE) — Questions and Answers

Question 1: A private employer wants to monitor employee emails on company systems. Which statement is MOST accurate legally?

Employers can never monitor employee communications
Employee consent is never needed for monitoring
Employers generally may monitor company systems if employees have been notified (Correct answer)
A warrant is required before any employer monitoring

Correct answer: Employers generally may monitor company systems if employees have been notified

Employers generally have the right to monitor company-owned systems, especially when employees are notified through acceptable use policies.

Question 2: What is the purpose of maintaining a chain of custody form?

To list passwords and usernames
To track software updates
To document handling of evidence (Correct answer)
To encrypt the data for transfer

Correct answer: To document handling of evidence

A chain of custody form is a vital legal document that meticulously records the handling, transfer, and storage of physical and digital evidence from its collection to its presentation in court. This detailed documentation proves the evidence's authenticity, prevents claims of tampering, and ensures its legal admissibility.

Question 3: What is 'indicators of compromise' (IOCs) and how are they used in incident response?

Documented software vulnerabilities used to patch systems
Observable artifacts (IP addresses, file hashes, registry keys) that indicate a system may be compromised (Correct answer)
Network performance benchmarks
Legal court orders for seizing digital evidence

Correct answer: Observable artifacts (IP addresses, file hashes, registry keys) that indicate a system may be compromised

IOCs are forensic artifacts such as malicious IP addresses, file hashes, registry entries, or domain names used to identify compromised systems and detect similar attacks.

Question 4: In the context of ransomware incident response, what is the recommended first action upon discovering an active ransomware infection on a networked machine?

Isolate the infected system from the network to prevent lateral movement and further encryption (Correct answer)
Pay the ransom immediately to prevent further encryption
Reinstall the operating system without capturing evidence
Run antivirus software while the system remains connected to the network

Correct answer: Isolate the infected system from the network to prevent lateral movement and further encryption

Immediate network isolation (unplugging the network cable or disabling the NIC) stops ransomware from spreading to other systems while preserving the local system for forensic analysis.

Question 5: In incident response triage, what does the order of volatility principle dictate about evidence collection?

Collect disk images after interviewing witnesses
Collect network logs before examining endpoints
Collect physical hard drives first as they contain the most data
Collect the most volatile data (RAM, running processes) first before it is lost (Correct answer)

Correct answer: Collect the most volatile data (RAM, running processes) first before it is lost

The order of volatility requires collecting the most transient data first—RAM, running processes, network connections—before powering down a system, as this data is lost on shutdown.

Question 6: What role does calibration play in Certified Computer Examiner technical accuracy?

Matters only during inspections
Optional for experienced professionals
Ensures instruments produce accurate results over time (Correct answer)
Only needed for new equipment

Correct answer: Ensures instruments produce accurate results over time

Regular calibration prevents measurement drift and ensures reliability.

Question 7: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?

Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
Planning, Execution, Review, Reporting
Identify, Protect, Detect, Respond
Triage, Investigation, Remediation, Closure

Correct answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity

NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.

Question 8: During malware analysis, what is the significance of an executable importing 'VirtualAlloc' and 'WriteProcessMemory' from the Windows API?

These functions are commonly used for process injection and shellcode execution in malicious software (Correct answer)
These functions are required for all GUI applications
These functions indicate the software is digitally signed
These functions indicate the software performs legitimate database operations

Correct answer: These functions are commonly used for process injection and shellcode execution in malicious software

VirtualAlloc allocates memory and WriteProcessMemory writes data into another process's memory space; together they are hallmarks of code injection techniques used by malware.

Question 9: Which Windows artifact stores up to the last 1,000 commands typed into the command prompt during a session?

MUI cache
LNK files
ConsoleHost history (Correct answer)
Prefetch files

Correct answer: ConsoleHost history

PowerShell/ConsoleHost_history.txt and the in-memory console command history store recently executed commands, which can provide evidence of attacker or user activity.

Question 10: A forensic examiner is asked by an attorney to alter a forensic report to support a client's position. The examiner should:

Refuse and report the request to the appropriate ethics board (Correct answer)
Comply if the request is in writing
Comply if the attorney is paying for the work
Alter only minor details that won't affect the outcome

Correct answer: Refuse and report the request to the appropriate ethics board

Altering forensic reports is unethical and potentially criminal; examiners must refuse and report such requests per professional standards.

Question 11: What does the term 'orphaned file' mean in the context of file system forensics?

A file that has been wiped with DoD-standard overwriting
A file whose directory entry exists but has no parent directory reference (Correct answer)
A file with no read permissions
A file stored in slack space

Correct answer: A file whose directory entry exists but has no parent directory reference

An orphaned file is one whose inode or MFT record still exists but has been disconnected from its parent directory, often due to corruption or anti-forensics techniques.

Question 12: What role does calibration play in Certified Computer Examiner technical accuracy?

Matters only during inspections
Optional for experienced professionals
Ensures instruments produce accurate results over time (Correct answer)
Only needed for new equipment

Correct answer: Ensures instruments produce accurate results over time

Regular calibration prevents measurement drift and ensures reliability.

Question 13: Which foundational principle is MOST important for Certified Computer Examiner success?

Minimum certification requirements
Maximizing financial returns
Narrow specialization only
Continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Question 14: What tool would a CCE examiner use to examine strings embedded in a malware binary without executing it?

Autopsy
Wireshark
The 'strings' utility or BinText (Correct answer)
Volatility

Correct answer: The 'strings' utility or BinText

The 'strings' command-line utility or tools like BinText extract printable character sequences from a binary, often revealing URLs, registry keys, and function names.

Question 15: What is the function of the Master File Table (MFT) in NTFS?

Manages boot processes
Logs system crashes
Stores user profiles
Contains file system metadata (Correct answer)

Correct answer: Contains file system metadata

The Master File Table (MFT) is a core component of the NTFS file system, acting as a database that stores critical metadata about every file and directory on the volume. This metadata includes file names, sizes, timestamps, security attributes, and the physical location of the data on the disk, making it essential for file system organization.

Question 16: When recovering data from a RAID 5 array with one failed drive, what is the minimum number of remaining drives needed to reconstruct the missing data?

The parity drive only
Any two drives
Any one drive
All remaining drives (Correct answer)

Correct answer: All remaining drives

RAID 5 stores parity distributed across all drives, so ALL remaining drives (n-1) must be operational to reconstruct the data from the failed drive using XOR parity.

Question 17: What is the forensic significance of the $I30 file in NTFS directory analysis?

It records file encryption certificates
It stores alternate data streams
It is the directory index that may contain entries for deleted files (Correct answer)
It tracks NTFS journal transactions

Correct answer: It is the directory index that may contain entries for deleted files

The $I30 attribute is the B-tree index for a directory and may contain slack entries revealing previously existing (deleted) files.

Question 18: Which action could compromise the admissibility of digital evidence in court?

Using a certified forensic tool
Failing to use a write blocker (Correct answer)
Creating an exact forensic image
Documenting every step

Correct answer: Failing to use a write blocker

Failing to use a write blocker is a critical error that can compromise the integrity of digital evidence. Without a write blocker, the forensic examiner's actions could inadvertently alter the suspect drive's contents, such as updating access times or creating temporary files. This alteration could lead to the evidence being deemed inadmissible in court, as its authenticity cannot be guaranteed.

Question 19: Which type of log would a CCE examiner most likely review to determine whether an attacker exfiltrated data via HTTP?

Active Directory replication logs
Web proxy or web server access logs (Correct answer)
BIOS event logs
Windows Event Logs

Correct answer: Web proxy or web server access logs

Web proxy and server access logs record HTTP/HTTPS requests, URLs, user agents, response codes, and transferred bytes useful for detecting data exfiltration.

Question 20: What is a 'hash set' and how is it used in digital evidence collection?

A collection of hash algorithms applied simultaneously for stronger verification
A security container for storing cryptographic keys used in evidence encryption
A set of hardware tools used to compute hash values in the field
A database of known file hash values used to identify known good or known bad files (Correct answer)

Correct answer: A database of known file hash values used to identify known good or known bad files

A hash set is a database of pre-computed hash values (such as NSRL for known good files or CAID for child exploitation material) used to quickly identify or exclude files during forensic examination.

Question 21: Which foundational principle is MOST important for Certified Computer Examiner success?

Minimum certification requirements
Narrow specialization only
Maximizing financial returns
Continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Continuous learning, ethical practice, and quality outcomes

Success requires learning, ethics, and quality focus.

Question 22: In a forensic investigation involving an SSD, why is traditional file recovery often less successful than with HDDs?

SSD sectors are too small for standard carving tools
The TRIM command allows the OS to zero out deleted data blocks proactively (Correct answer)
SSDs compress all data before writing
SSDs use proprietary encryption by default

Correct answer: The TRIM command allows the OS to zero out deleted data blocks proactively

The TRIM command notifies the SSD controller that deleted blocks can be wiped immediately, causing the underlying data to be erased before forensic recovery is attempted.

Question 23: What is the primary difference between a logical acquisition and a physical acquisition of a mobile device?

Physical acquisition only works on Android devices; logical acquisition works on all platforms
Physical acquisition requires the device to be powered on; logical acquisition can be done powered off
Logical acquisition is faster but only captures allocated files; physical acquisition captures the entire memory chip including deleted data (Correct answer)
Logical acquisition requires specialized chip-off equipment; physical acquisition uses standard cables

Correct answer: Logical acquisition is faster but only captures allocated files; physical acquisition captures the entire memory chip including deleted data

Logical acquisition extracts only allocated, accessible files through the OS, while physical acquisition captures a bit-for-bit image of the memory including deleted and unallocated space.

Question 24: In NTFS, what structure stores the metadata for every file and directory on the volume?

Volume Boot Record
Partition Table
Master File Table (Correct answer)
File Allocation Table

Correct answer: Master File Table

The Master File Table (MFT) in NTFS contains at least one record for every file and directory, storing metadata such as timestamps, permissions, and data locations.

Question 25: Which approach is MOST important for CCE professionals applying technical procedures?

Same technique without variation
Fastest method regardless of standards
Adhering to protocols while adapting to conditions (Correct answer)
Personal shortcuts

Correct answer: Adhering to protocols while adapting to conditions

Balancing protocol adherence with professional adaptation ensures quality.

Question 26: What does the acronym 'MACB' refer to in NTFS timestamp analysis?

Modified, Archived, Created, Backed-up
Metadata, Allocation, Checksum, Backup
Master, Attributed, Cached, Backed-up
Modified, Accessed, Changed, Born (Correct answer)

Correct answer: Modified, Accessed, Changed, Born

MACB stands for Modified, Accessed, Changed (MFT entry changed), and Born (created), representing the four timestamps stored in NTFS MFT entries for each file.

Question 27: Which legislation governs unauthorized access to computer systems in the U.S.?

Privacy Act
Computer Fraud and Abuse Act (Correct answer)
Digital Millennium Copyright Act
Freedom of Information Act

Correct answer: Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is a U.S. federal law that prohibits unauthorized access to protected computers. It criminalizes various computer-related activities, including accessing a computer without authorization or exceeding authorized access. This act is a cornerstone for prosecuting cybercrimes and defines the legal boundaries for computer system interactions.

Question 28: What is 'chip-off' forensics and when is it typically employed?

Extracting SIM card data without the device's PIN
Disassembling a hard drive to read platters with an electron microscope
Physically removing flash memory chips from a device to read them directly with specialized equipment (Correct answer)
Removing the CPU to read cached memory from the processor registers

Correct answer: Physically removing flash memory chips from a device to read them directly with specialized equipment

Chip-off forensics involves physically desoldering and removing flash memory chips (NAND/NOR) from a device to read their raw contents when software-based acquisition methods fail.

Question 29: In exFAT (used on large flash media), what replaces the traditional File Allocation Table for tracking cluster usage?

Cluster Map File
Allocation Bitmap (Correct answer)
B-tree Index
Inode Table

Correct answer: Allocation Bitmap

exFAT uses an Allocation Bitmap to track which clusters are in use rather than a linked-list FAT structure, improving performance for large volumes.

Question 30: What is the primary purpose of a YARA rule in malware analysis and incident response?

Automating patch deployment on infected systems
Monitoring network traffic in real time
Pattern matching to identify and classify malware based on textual or binary patterns (Correct answer)
Encrypting forensic disk images

Correct answer: Pattern matching to identify and classify malware based on textual or binary patterns

YARA rules define patterns (strings, byte sequences, conditions) used to scan files and memory to identify and classify malware families across large datasets.

Question 31: During an incident response investigation, an examiner finds a PowerShell script with base64-encoded content. What is the most appropriate first step?

Decode the base64 content in an isolated environment to determine its purpose (Correct answer)
Ignore it as PowerShell encoding is always legitimate
Restart the affected system to clear the script from memory
Delete the script immediately as it is definitely malicious

Correct answer: Decode the base64 content in an isolated environment to determine its purpose

Base64 encoding in PowerShell is a common obfuscation technique; decoding it in an isolated environment reveals the actual commands being executed without risk.

Question 32: In a GUID Partition Table (GPT) disk, where is the primary partition table header located?

Sector 2
Sector 1 (Correct answer)
Last sector of the disk
Sector 0

Correct answer: Sector 1

In GPT, sector 0 holds a Protective MBR for legacy compatibility, and the primary GPT header is stored in sector 1 (LBA 1), with a backup at the last sector.

Question 33: What is the CORRECT sequence when performing a Certified Computer Examiner technical procedure?

Plan, prepare, execute, verify, and document (Correct answer)
Execute, then plan
Document, execute, plan
Execute immediately, document if issues arise

Correct answer: Plan, prepare, execute, verify, and document

This systematic sequence ensures quality and accountability.

Question 34: Which Windows artifact records the execution history of programs and is examined during incident response to identify malware execution?

Prefetch files (C:\Windows\Prefetch\) (Correct answer)
Event Log 4624
Volume Shadow Copies
Browser cookies

Correct answer: Prefetch files (C:\Windows\Prefetch\)

Windows Prefetch files record metadata about program execution, including the executable name, run count, and last run time, helping investigators confirm whether malware was executed.

Question 35: In HFS+ (Mac OS Extended), which structure is equivalent to the NTFS MFT and stores file metadata?

Catalog File (Correct answer)
Extents Overflow File
Allocation File
Journal

Correct answer: Catalog File

The HFS+ Catalog File is a B-tree that stores records for all files and directories on the volume, serving the same metadata role as the NTFS MFT.

Question 36: What is the default cluster size for an NTFS volume formatted on a partition larger than 2 GB?

512 bytes
4,096 bytes (Correct answer)
8,192 bytes
1,024 bytes

Correct answer: 4,096 bytes

Windows defaults to 4,096-byte (4 KB) clusters for NTFS volumes larger than 2 GB, balancing storage efficiency and performance.

Question 37: Which protocol captures full packet data at the network level and is commonly analyzed in network forensics investigations?

SMTP
PCAP (Packet Capture) (Correct answer)
HTTP
FTP

Correct answer: PCAP (Packet Capture)

PCAP files store full packet data captured from network interfaces and are the standard format analyzed by tools like Wireshark in network forensics.

Question 38: Which type of legal process generally requires the LEAST judicial oversight when obtaining digital records from a third-party provider?

Court order under 18 U.S.C. § 2703(d)
Emergency disclosure request
Search warrant
Grand jury subpoena (Correct answer)

Correct answer: Grand jury subpoena

A grand jury subpoena requires no judicial approval before issuance, making it the process with the least pre-issuance oversight.

Question 39: Which approach is MOST important for CCE professionals applying technical procedures?

Fastest method regardless of standards
Same technique without variation
Adhering to protocols while adapting to conditions (Correct answer)
Personal shortcuts

Correct answer: Adhering to protocols while adapting to conditions

Balancing protocol adherence with professional adaptation ensures quality.

Question 40: Why is maintaining confidentiality important in digital forensics?

To comply with advertising rules
To increase report length
To allow peer collaboration
To prevent unauthorized disclosure (Correct answer)

Correct answer: To prevent unauthorized disclosure

Maintaining confidentiality in digital forensics is crucial to protect sensitive information, personal data, and proprietary secrets discovered during an investigation. Unauthorized disclosure could violate privacy laws, harm individuals or organizations, or compromise ongoing legal proceedings. It ensures that sensitive findings are handled responsibly and shared only with authorized parties.

Question 41: During malware analysis, what is the difference between static and dynamic analysis?

Static analysis examines the malware without executing it; dynamic analysis runs the malware in a controlled environment (Correct answer)
Static analysis runs the malware; dynamic analysis reads the binary without executing it
Static analysis uses network traffic; dynamic analysis uses memory dumps
Static analysis is faster than dynamic analysis in all cases

Correct answer: Static analysis examines the malware without executing it; dynamic analysis runs the malware in a controlled environment

Static analysis inspects malware code, strings, and structure without execution, while dynamic analysis runs the malware in a sandbox to observe its behavior.

Question 42: An investigator observes a large volume of outbound DNS queries to randomly generated domain names. This pattern most likely indicates:

An NTP amplification attack
Domain Generation Algorithm (DGA) malware activity (Correct answer)
Normal recursive DNS resolution
A misconfigured DHCP server

Correct answer: Domain Generation Algorithm (DGA) malware activity

Domain Generation Algorithms (DGAs) are used by malware to generate pseudo-random domain names to contact command-and-control servers while evading blacklists.

Question 43: What is lateral movement in the context of an incident response investigation?

Transferring data between two forensic workstations
Moving forensic evidence from one location to another
Techniques used by attackers to progressively move through a network after initial compromise to reach target systems (Correct answer)
Migrating virtual machines between hypervisor hosts

Correct answer: Techniques used by attackers to progressively move through a network after initial compromise to reach target systems

Lateral movement refers to attacker techniques such as pass-the-hash, RDP exploitation, or credential theft used to pivot from an initially compromised system to other valuable targets on the same network.

Question 44: What is the primary forensic reason for placing a mobile device in Airplane Mode during evidence acquisition?

To prevent remote wiping or unauthorized data modification (Correct answer)
To increase USB data transfer speeds
To enable USB debugging mode automatically
To save battery life during long acquisitions

Correct answer: To prevent remote wiping or unauthorized data modification

Airplane Mode disables all wireless communications, preventing remote wipe commands or data synchronization that could alter or destroy evidence on the device.

Question 45: When documenting CCE assessment findings, which approach is MOST appropriate?

Use expert-only jargon
Record objective findings and observations factually (Correct answer)
Include only positive findings
Summarize verbally only

Correct answer: Record objective findings and observations factually

Objective, factual documentation supports decision-making and scrutiny.

Question 46: What does TTL (Time to Live) manipulation in network packets potentially indicate to a forensic examiner?

Normal routing behavior
Possible OS fingerprinting evasion or firewall bypass attempts (Correct answer)
Legitimate load balancing
Standard VPN tunneling

Correct answer: Possible OS fingerprinting evasion or firewall bypass attempts

Abnormal TTL values can indicate OS fingerprinting evasion, firewall bypass techniques, or packet crafting by an attacker.

Question 47: Which tool is commonly used to create a verified forensic image?

VirtualBox
FTK Imager (Correct answer)
Wireshark
Disk Cleanup

Correct answer: FTK Imager

FTK Imager is a widely used and trusted software tool in digital forensics for creating verified forensic images of various storage devices. It can generate bit-for-bit copies in several formats and includes hashing capabilities to ensure the integrity and authenticity of the acquired evidence.

Question 48: When a CCE professional encounters unexpected results during a procedure, the FIRST action should be:

Report without assessment
Stop, assess, and determine whether to proceed or seek guidance (Correct answer)
Continue and address later
Repeat immediately

Correct answer: Stop, assess, and determine whether to proceed or seek guidance

Stopping to assess ensures safety before further action.

Question 49: Which factor MOST affects quality of CCE technical outcomes?

Equipment brand
Time of day
Practitioner's training, preparation, and attention to detail (Correct answer)
Speed of completion

Correct answer: Practitioner's training, preparation, and attention to detail

The practitioner's competence is the most significant factor.

Question 50: What is the CORRECT sequence when performing a Certified Computer Examiner technical procedure?

Plan, prepare, execute, verify, and document (Correct answer)
Execute immediately, document if issues arise
Execute, then plan
Document, execute, plan

Correct answer: Plan, prepare, execute, verify, and document

This systematic sequence ensures quality and accountability.

Question 51: How should Certified Computer Examiner professionals handle updated procedures?

Continue original method
Review updates, complete training, implement revisions (Correct answer)
Wait for enforcement
Apply only to new cases

Correct answer: Review updates, complete training, implement revisions

Staying current with procedural updates is a professional obligation.

Question 52: What is a 'chain of custody' and why is it critical during incident response investigations in the US?

A backup schedule for forensic disk images
A network diagram showing how the attack propagated
A list of all malware found on a system
A documented record tracking who handled evidence, when, and what was done to it, ensuring admissibility in US courts (Correct answer)

Correct answer: A documented record tracking who handled evidence, when, and what was done to it, ensuring admissibility in US courts

Chain of custody documentation ensures evidence integrity and tracks every person who accessed the evidence, which is required for the evidence to be admissible in US legal proceedings.

Question 53: In incident response, what does the term 'containment' refer to?

Restoring systems to their pre-incident state
Deleting all evidence of the incident
Limiting the spread and impact of an incident while preserving forensic evidence (Correct answer)
Reporting the incident to law enforcement

Correct answer: Limiting the spread and impact of an incident while preserving forensic evidence

Containment involves taking steps to stop the incident from spreading further while carefully preserving evidence for forensic analysis.

Question 54: What is the CORRECT sequence when performing a Certified Computer Examiner technical procedure?

Execute, then plan
Document, execute, plan
Plan, prepare, execute, verify, and document (Correct answer)
Execute immediately, document if issues arise

Correct answer: Plan, prepare, execute, verify, and document

This systematic sequence ensures quality and accountability.

Question 55: Which assessment method provides the MOST reliable data for CCE professionals?

Single-source stakeholder data
Informal verbal feedback
Standardized tools combined with professional observation (Correct answer)
Social media reviews

Correct answer: Standardized tools combined with professional observation

Combining standardized tools with observation provides comprehensive data.

Question 56: Which approach is MOST important for CCE professionals applying technical procedures?

Fastest method regardless of standards
Same technique without variation
Personal shortcuts
Adhering to protocols while adapting to conditions (Correct answer)

Correct answer: Adhering to protocols while adapting to conditions

Balancing protocol adherence with professional adaptation ensures quality.

Question 57: Which federal law specifically prohibits unauthorized interception of electronic communications?

Computer Fraud and Abuse Act
Electronic Communications Privacy Act (Correct answer)
Stored Communications Act
USA PATRIOT Act

Correct answer: Electronic Communications Privacy Act

The Electronic Communications Privacy Act (ECPA) of 1986 prohibits unauthorized interception of wire, oral, and electronic communications.

Question 58: What is a 'rootkit' and how does it complicate digital forensic investigations?

A legitimate system administration tool used for root access
A vulnerability scanner used by attackers
Malware that hides its presence by modifying OS structures to conceal files, processes, and network connections (Correct answer)
A type of ransomware that encrypts the root directory

Correct answer: Malware that hides its presence by modifying OS structures to conceal files, processes, and network connections

Rootkits subvert OS functions to hide malicious activity, making standard tools return false information and requiring offline analysis or specialized tools to detect.

Question 59: What is the forensic significance of a mobile device's IMEI number during an investigation?

It stores the device's encryption keys used to protect user data
It contains the device owner's personal identifying information
It uniquely identifies the physical hardware device for linking to network activity and ownership records (Correct answer)
It contains the carrier's network authentication certificates

Correct answer: It uniquely identifies the physical hardware device for linking to network activity and ownership records

The IMEI (International Mobile Equipment Identity) is a unique 15-digit hardware identifier that allows investigators to link a specific physical device to carrier records, network activity logs, and ownership history.

Question 60: A forensic examiner is analyzing a disk and finds that the first sector of a partition contains 'EB 52 90 4E 54 46 53'. What does this indicate?

The sector is a GPT header
The partition is unformatted
The partition uses NTFS (Correct answer)
The partition uses FAT32

Correct answer: The partition uses NTFS

'EB 52 90' is the x86 jump instruction prefix and '4E 54 46 53' is the ASCII string 'NTFS', which are the first bytes of an NTFS Volume Boot Record.

Question 61: Which of the following file carving signatures correctly identifies the start of a JPEG file?

25 50 44 46
50 4B 03 04
FF D8 FF (Correct answer)
89 50 4E 47

Correct answer: FF D8 FF

JPEG files begin with the magic bytes FF D8 FF, which represent the Start of Image (SOI) marker used to identify JPEG/JFIF data.

Question 62: What Windows file system feature can store alternate versions of a file's $DATA attribute under a different name, sometimes used to hide data?

Sparse files
Symbolic links
Reparse points
Alternate Data Streams (Correct answer)

Correct answer: Alternate Data Streams

NTFS Alternate Data Streams (ADS) allow additional data to be associated with a file under a colon-separated name (e.g., file.txt:hidden), which is invisible in standard directory listings.

Question 63: Which factor MOST affects quality of CCE technical outcomes?

Practitioner's training, preparation, and attention to detail (Correct answer)
Equipment brand
Speed of completion
Time of day

Correct answer: Practitioner's training, preparation, and attention to detail

The practitioner's competence is the most significant factor.

Question 64: Which of the following best describes the concept of 'time stomping' in a forensic investigation?

Recovering overwritten timestamps from the MFT
Synchronizing system clocks across networked devices
Deliberately modifying file timestamps to obscure activity (Correct answer)
Adjusting timestamps for time zone differences

Correct answer: Deliberately modifying file timestamps to obscure activity

Time stomping is an anti-forensics technique where an attacker alters MAC(E) timestamps on files to disguise when they were created, modified, or accessed.

Question 65: What is process hollowing, and why is it significant in malware analysis?

Duplicating a process in memory; significant for load balancing
Injecting malicious code into a legitimate process's memory space by replacing its contents; used to evade detection (Correct answer)
Terminating system processes to cause a denial of service; significant for availability analysis
Creating a new legitimate process; significant for system performance analysis

Correct answer: Injecting malicious code into a legitimate process's memory space by replacing its contents; used to evade detection

Process hollowing involves starting a legitimate process, unmapping its code from memory, and replacing it with malicious code to evade security tools that whitelist trusted processes.

Question 66: What role does calibration play in Certified Computer Examiner technical accuracy?

Ensures instruments produce accurate results over time (Correct answer)
Optional for experienced professionals
Only needed for new equipment
Matters only during inspections

Correct answer: Ensures instruments produce accurate results over time

Regular calibration prevents measurement drift and ensures reliability.

Question 67: When analyzing a JPEG image for metadata, which tool and metadata type would reveal the GPS coordinates where a photo was taken?

ExifTool, EXIF GPS metadata (Correct answer)
Foremost, file header signatures
Binwalk, embedded file analysis
Strings tool, ASCII text extraction

Correct answer: ExifTool, EXIF GPS metadata

ExifTool parses EXIF metadata embedded in JPEG files, including GPS latitude/longitude coordinates recorded by camera-enabled devices.

Question 68: During memory forensics, which Volatility plugin would a CCE examiner use to list running processes from a memory dump?

dlllist
pslist or pstree (Correct answer)
imageinfo
filescan

Correct answer: pslist or pstree

The 'pslist' and 'pstree' plugins in Volatility enumerate running processes from a memory image, revealing active and potentially malicious processes.

Question 69: What is the role of the Volume Boot Record (VBR) in a FAT or NTFS volume?

Stores the partition style (MBR vs GPT)
Stores user account security identifiers
Contains the BPB and bootstrap code needed to mount the volume (Correct answer)
Tracks bad cluster locations

Correct answer: Contains the BPB and bootstrap code needed to mount the volume

The Volume Boot Record contains the BIOS Parameter Block (BPB), which describes volume geometry and layout, and bootstrap code that initiates the OS loading process.

Question 70: Under the Fourth Amendment, which standard must law enforcement meet to obtain a warrant for digital evidence?

Probable cause (Correct answer)
Reasonable suspicion
Clear and convincing evidence
Preponderance of evidence

Correct answer: Probable cause

The Fourth Amendment requires probable cause supported by oath or affirmation before a warrant can be issued.

Question 71: How should Certified Computer Examiner professionals handle updated procedures?

Wait for enforcement
Continue original method
Apply only to new cases
Review updates, complete training, implement revisions (Correct answer)

Correct answer: Review updates, complete training, implement revisions

Staying current with procedural updates is a professional obligation.

Question 72: What types of information can be recovered from a mobile device's GPS and location-related artifacts during a forensic examination?

Historical location trails, geotagged media metadata, and cached location data from apps (Correct answer)
Only the current real-time GPS coordinates of the device
Encrypted carrier-side communication metadata only
Network credentials and saved WiFi access point passwords

Correct answer: Historical location trails, geotagged media metadata, and cached location data from apps

Mobile devices accumulate rich historical location data across multiple artifact types including GPS logs, geotagged photo EXIF data, cached map tiles, and location-aware application databases.

Question 73: What is the significance of ACPO (Association of Chief Police Officers) guidelines in digital forensics?

They govern cross-border evidence sharing between countries
They provide principles for handling digital evidence including non-alteration and documentation (Correct answer)
They define encryption standards for evidence storage
They establish minimum hardware requirements for forensic workstations

Correct answer: They provide principles for handling digital evidence including non-alteration and documentation

ACPO guidelines establish four key principles for digital evidence handling, most notably that original data must not be altered and all actions must be documented and auditable.

Question 74: Which exception to the warrant requirement allows law enforcement to conduct a warrantless search to prevent imminent destruction of evidence?

Consent exception
Good faith exception
Exigent circumstances (Correct answer)
Inevitable discovery

Correct answer: Exigent circumstances

The exigent circumstances exception permits warrantless searches when evidence would likely be destroyed before a warrant could be obtained.

Question 75: Which file system supports journaling and is used on macOS?

NTFS
EXT2
APFS (Correct answer)
FAT32

Correct answer: APFS

APFS (Apple File System) is the modern, default file system for macOS, iOS, and other Apple operating systems, designed specifically for flash and solid-state drives. It supports advanced features like strong encryption, space sharing, snapshots, and journaling, which significantly enhance data integrity and overall system reliability.

Question 76: During data carving, a forensic tool identifies a file header signature but cannot find a footer signature. What is the most likely outcome?

The file will not be recovered at all
The carved file will be flagged as encrypted
The tool will skip to the next partition
The tool will carve a file up to a maximum size limit (Correct answer)

Correct answer: The tool will carve a file up to a maximum size limit

When no footer is found, most carving tools recover data up to a configurable maximum file size, which may result in a larger-than-actual file or truncated output.

Question 77: A forensic examiner finds a file with a logical size of 1 byte but a physical size of 4,096 bytes on an NTFS volume. What best explains this difference?

The file is encrypted
The file is compressed
Cluster slack space (Correct answer)
The MFT record is corrupt

Correct answer: Cluster slack space

Cluster slack (file slack) is the unused space between the logical end of file data and the end of the last allocated cluster, which may contain remnants of previously stored data.

Question 78: Which file carving technique reconstructs files based on header and footer signatures rather than file system metadata?

Signature-based carving (Correct answer)
Journal replay
Logical file recovery
Inode recovery

Correct answer: Signature-based carving

Signature-based carving identifies file boundaries using known magic bytes (headers) and terminators (footers) to reconstruct files from raw disk data.

Question 79: When Certified Computer Examiner assessment results are inconclusive, the BEST practice is to:

Discard and start over
Delay until favorable
Report as definitive
Conduct additional assessment using alternative methods (Correct answer)

Correct answer: Conduct additional assessment using alternative methods

Alternative methods help triangulate and clarify findings.

Question 80: When a CCE professional encounters unexpected results during a procedure, the FIRST action should be:

Continue and address later
Repeat immediately
Stop, assess, and determine whether to proceed or seek guidance (Correct answer)
Report without assessment

Correct answer: Stop, assess, and determine whether to proceed or seek guidance

Stopping to assess ensures safety before further action.

Question 81: Which NTFS attribute type stores the actual file content when the file is small enough to fit within the MFT record itself?

$DATA (resident) (Correct answer)
$STANDARD_INFORMATION
$BITMAP
$FILE_NAME

Correct answer: $DATA (resident)

When file data is small enough, NTFS stores it as a resident $DATA attribute directly within the MFT record, eliminating the need for separate cluster allocation.

Question 82: Which file system is commonly used by Windows operating systems?

HFS+
EXT4
APFS
NTFS (Correct answer)

Correct answer: NTFS

NTFS (New Technology File System) is the default and most commonly used file system for Microsoft Windows operating systems. It offers advanced features compared to older file systems, including improved security, journaling for data integrity, support for large files and volumes, and robust data recovery capabilities.

Question 83: When examining the $UsnJrnl ($J) file in NTFS, what type of evidence does a forensic examiner primarily find?

Encrypted file keys
User logon and logoff events
Registry hive transaction records
A chronological log of file system changes including creates, deletes, and renames (Correct answer)

Correct answer: A chronological log of file system changes including creates, deletes, and renames

The NTFS Update Sequence Number Journal ($UsnJrnl) records change reasons and timestamps for file and directory operations, providing a timeline of file system activity.

Question 84: Under international digital investigations, the Budapest Convention on Cybercrime primarily facilitates:

Extradition of all cybercrime suspects to the US
Uniform sentencing for cybercriminals worldwide
Cross-border cooperation and mutual legal assistance in cybercrime investigations (Correct answer)
A global digital evidence standards body

Correct answer: Cross-border cooperation and mutual legal assistance in cybercrime investigations

The Budapest Convention (Council of Europe Treaty No. 185) is the first international treaty harmonizing cybercrime laws and enabling cross-border evidence sharing.

Question 85: Which legal concept holds that digital evidence must be shown to be what it purports to be before it can be admitted in court?

Relevance
Best evidence rule
Hearsay exception
Authentication (Correct answer)

Correct answer: Authentication

Authentication (FRE 901) requires the proponent to produce sufficient evidence that the item is what it is claimed to be.

Question 86: What is a 'sandbox' in the context of malware analysis?

A forensic write blocker
A network segment used for testing patches
A secure offline backup system
An isolated virtual environment used to execute and observe malware behavior safely (Correct answer)

Correct answer: An isolated virtual environment used to execute and observe malware behavior safely

A sandbox is an isolated environment (typically a VM) where malware can be executed and monitored without risk of infecting production systems.

Question 87: Which FAT32 structure contains a 4-byte value indicating whether a cluster is in use, free, or the end of a chain?

Boot Sector
Directory Entry
Root Directory
File Allocation Table (Correct answer)

Correct answer: File Allocation Table

The File Allocation Table itself holds a 28-bit entry (in a 32-bit field) per cluster that indicates its status: free (0x00000000), end-of-chain (0x0FFFFFFF), or the next cluster in the chain.

Question 88: Which method is most commonly used to recover deleted files?

Formatting
File carving (Correct answer)
Disk defragmentation
Data masking

Correct answer: File carving

File carving is a powerful data recovery technique used to extract files from raw disk images or unallocated space without relying on the file system's metadata. It works by searching for known file headers and footers (signatures) to reconstruct files, making it highly effective for recovering deleted, corrupted, or fragmented data.

Question 89: How should Certified Computer Examiner professionals handle updated procedures?

Review updates, complete training, implement revisions (Correct answer)
Continue original method
Apply only to new cases
Wait for enforcement

Correct answer: Review updates, complete training, implement revisions

Staying current with procedural updates is a professional obligation.

Question 90: In mobile forensics, what is the term for physically removing and reading the memory chip directly from the circuit board?

Chip-off extraction (Correct answer)
Logical extraction
Bootloader extraction
JTAG extraction

Correct answer: Chip-off extraction

Chip-off extraction involves physically desoldering the memory chip from the device's PCB and reading it with specialized equipment, providing raw access to all stored data.

Question 91: Which data recovery scenario benefits most from the use of a write blocker?

Recovering data from a network share
Rebuilding a corrupted RAID array
Imaging a suspect drive without altering its contents (Correct answer)
Decrypting a BitLocker-protected volume

Correct answer: Imaging a suspect drive without altering its contents

A write blocker prevents any write commands from reaching the source drive during imaging, preserving the forensic integrity of the original evidence.

Question 92: Under the Stored Communications Act (SCA), service providers are generally prohibited from:

Voluntarily disclosing the contents of stored communications to third parties (Correct answer)
Complying with court orders for metadata
Providing subscriber information to law enforcement with a subpoena
Storing user data beyond 90 days

Correct answer: Voluntarily disclosing the contents of stored communications to third parties

The SCA prohibits voluntary disclosure of stored communication contents to non-government entities without legal process.

Question 93: Which factor MOST affects quality of CCE technical outcomes?

Equipment brand
Practitioner's training, preparation, and attention to detail (Correct answer)
Speed of completion
Time of day

Correct answer: Practitioner's training, preparation, and attention to detail

The practitioner's competence is the most significant factor.

Question 94: Which approach is MOST important for CCE professionals applying technical procedures?

Personal shortcuts
Same technique without variation
Adhering to protocols while adapting to conditions (Correct answer)
Fastest method regardless of standards

Correct answer: Adhering to protocols while adapting to conditions

Balancing protocol adherence with professional adaptation ensures quality.

Question 95: In Wireshark, which display filter would isolate only DNS query traffic?

dns.flags.response == 0 (Correct answer)
ip.proto == 17
tcp.port == 53
udp.port == 53

Correct answer: dns.flags.response == 0

The filter dns.flags.response == 0 specifically isolates DNS query packets, excluding responses.

Question 96: Which network forensic artifact would best help determine if a user connected to an unauthorized external VPN service?

Browser history only
File system metadata
Firewall logs showing outbound connections on VPN ports (e.g., UDP 1194 for OpenVPN) (Correct answer)
Active Directory authentication logs

Correct answer: Firewall logs showing outbound connections on VPN ports (e.g., UDP 1194 for OpenVPN)

Firewall logs showing outbound UDP 1194 (OpenVPN), TCP 1723 (PPTP), or other VPN protocol ports to external IPs indicate unauthorized VPN usage.

Question 97: Which of the following is NOT typically considered volatile data during a live system investigation?

Currently logged-in users
Open network sockets
Files in the Recycle Bin (Correct answer)
ARP cache entries

Correct answer: Files in the Recycle Bin

Files in the Recycle Bin are stored on disk and persist after shutdown, making them non-volatile data unlike ARP cache, logged-in users, and open network sockets.

Question 98: During evidence collection at a business, the examiner discovers the primary suspect's workstation is connected to a RAID array. How should the RAID array be handled?

Document the RAID configuration and controller settings before disassembly, then image individually (Correct answer)
Leave the RAID array in place and only image the suspect's workstation
Image each individual drive separately without documenting the RAID configuration
Power off the RAID array immediately and seize only the drives without documentation

Correct answer: Document the RAID configuration and controller settings before disassembly, then image individually

RAID configuration details (type, stripe size, drive order) must be documented before disassembly because this information is needed to reconstruct the logical volume from individual drive images.

Question 99: Which Windows registry hive contains autorun entries most commonly abused by malware for persistence?

HKEY_LOCAL_MACHINE\SAM\SAM\Domains
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run (Correct answer)
HKEY_CLASSES_ROOT\CLSID
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Correct answer: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

The 'Run' and 'RunOnce' keys under HKCU and HKLM \Software\Microsoft\Windows\CurrentVersion are the most common registry locations malware uses to establish persistence.

Question 100: When Certified Computer Examiner assessment results are inconclusive, the BEST practice is to:

Report as definitive
Conduct additional assessment using alternative methods (Correct answer)
Discard and start over
Delay until favorable

Correct answer: Conduct additional assessment using alternative methods

Alternative methods help triangulate and clarify findings.

Question 101: What is the primary first step a forensic examiner should take when acquiring a mobile device as evidence?

Document and photograph the device in its current state (Correct answer)
Connect it immediately to a forensic workstation
Install forensic software on the device
Power off the device to preserve battery life

Correct answer: Document and photograph the device in its current state

Documenting and photographing the device in its current state establishes the chain of custody and preserves the initial evidence condition before any acquisition steps.

Certified Computer Examiner (CCE)

The CCE, offered by the International Society of Forensic Computer Examiners (ISFCE), validates expertise in digital forensics including evidence acquisition, file system analysis, network investigations, incident response, and forensic reporting.

100

Questions

60 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds