FIA Past Paper 10

A train 480 m long crosses a pole in 24 seconds. Speed is:

A train 360 m long crosses a 540 m platform in 45 seconds. Speed is:

A boat speed in still water is 20 km/h and stream speed is 5 km/h. Time to travel 75 km downstream and 45 km upstream is:

Find the next number: 13, 28, 59, 122, 249, ___

Find the next number: 8, 19, 41, 85, 173, ___

Find the next number: 5, 16, 49, 148, 445, ___

Find the next letter: E, J, P, W, E, ___

If x + y = 34 and xy = 273, then x² + y² =:

If x - y = 15 and xy = 286, then x² + y² =:

Ratio of two numbers is 15:23 and their sum is 456. Larger number is:

A number is increased by 125% and then decreased by 55.56%. Net change is approximately:

Average of 30 numbers is 54. If one number 112 is removed, new average is:

Probability of getting no tail when four coins are tossed is:

LCM of 54, 72, and 90 is:

HCF of 198, 330, and 462 is:

A dishonest shopkeeper uses 650 g instead of 1 kg but sells at cost price. His gain is approximately:

Which is most important when collecting electronic evidence?

In digital forensics, a write blocker is used to:

The main purpose of calculating a hash value is to:

Which of the following is an example of volatile evidence?

Chain of custody means:

Which action should be avoided while collecting digital evidence?

A forensic image is:

Metadata refers to:

Which hash algorithm is commonly used to verify file integrity?

The first step after seizing a mobile phone should usually be to:

Faraday bags are used to:

Which evidence is most likely to be lost after shutting down a computer?

The best practice before analyzing a hard drive is to:

A hash mismatch between original evidence and forensic copy means:

Digital evidence should be stored in a way that ensures:

Which of the following may contain browser history?

Deleted files can sometimes be recovered because:

In cyber investigations, log files are useful because they can show:

Which is the safest method for preserving digital evidence?

Evidence authenticity means:

Which of the following is most important in a forensic report?

A screenshot alone is generally weaker than a forensic capture because:

Which device can store digital evidence?

The purpose of documenting the date, time, and person handling evidence is to:

Which of the following is poor evidence handling?

In digital forensics, “integrity” means:

Which evidence source is most useful for proving login activity?

Which of the following should be collected first when live data is needed?

A digital forensic examiner should be:

Which is an example of electronic evidence?

Why should original evidence not be modified?

A forensic timeline helps investigators understand:

Which information can email headers provide?

Which of the following is a risk in cloud evidence collection?

Which is the best description of admissible evidence?

What should investigators do before disconnecting a running computer, when possible?

Which of the following can affect the credibility of electronic evidence?

A forensic copy should be analyzed instead of the original because:

Which is most likely to prove that a file was changed?

Evidence stored on a suspect’s phone may include:

Which principle is central to digital evidence handling?

Which of the following is a cybercrime-related evidence source?

Which action helps prove that evidence was not tampered with?

If a seized laptop is encrypted, investigators should:

Digital evidence is fragile because:

Which of the following is best for storing seized digital evidence?

What does “read-only access” help prevent?

Which of the following is most important in presenting electronic evidence in court?

What should be recorded when collecting electronic evidence?

The strongest approach in digital evidence collection is to:

The main purpose of imaging a hard drive is to:

Which of the following should be avoided during evidence collection?

A forensic hash value helps prove that:

Which type of evidence can be found in browser cookies?

When collecting evidence from a live computer, investigators should first consider:

A proper evidence label should include:

Which of the following is an example of network evidence?

Digital evidence must be handled carefully because it is:

A forensic examiner should work mainly on:

The purpose of a seizure memo is to:

Which action can damage the integrity of electronic evidence?

In digital forensics, deleted files may be found in:

The term “bit-by-bit copy” means:

Which document proves who handled evidence and when?

Which is the best method to protect mobile evidence from remote wiping?

Which of the following may contain location evidence?

Which term means proving that evidence is genuine?

A forensic report should be:

Which of the following is a common source of digital evidence in financial cybercrime?

Why are timestamps important in digital evidence?

Which is an example of poor digital evidence practice?

Which evidence can help identify unauthorized access?

Digital evidence collected without proper procedure may become:

Which of the following can preserve evidence integrity?

What is the purpose of access control in evidence storage?

A forensic image differs from a normal copy because it:

Which evidence may help prove communication between suspects?

The role of a digital forensic expert is to:

Which of the following may contain evidence of file transfer?

Which principle should guide electronic evidence collection?

Which is the best reason to photograph a digital crime scene?

Which of the following is not a good practice?

 In a cybercrime investigation, IP address logs may help identify:

Which of the following can be considered electronic evidence?