Chapter 39 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band at the bottom. Commit to an answer before you scroll — the discipline of not peeking is the same one that keeps you from "just looking" at a customer's drive.

Multiple choice

Q1. Why does certification function as a proxy for trust in digital forensics and data recovery? - A) Because federal law requires a certification before anyone may image a drive. - B) Because the field generally has no license to practice, so the market and courts adopted certification as a readable shorthand for competence. - C) Because certifications never expire and are therefore permanent proof of skill. - D) Because a degree in the field is impossible to obtain.

Q2. Which statement correctly distinguishes the four terms a cross-examiner cares about? - A) A license is granted by a vendor and proves tool skill. - B) An accreditation applies to a person and proves they passed an exam. - C) A license is government permission to practice; an accreditation applies to an organization (a lab under ISO 17025, or a certifying body under ISO 17024). - D) A degree expires every three years and must be renewed with CPEs.

Q3. The GIAC (SANS) forensic exams have a distinctive format. Which is it, and what is the single highest-leverage way to prepare? - A) Closed-book, memorization-only; prepare with flashcards. - B) Proctored but open-book; the highest-leverage task is building your own alphabetized index mapping concepts to book and page. - C) Pure take-home practical with no time limit; prepare by writing one report. - D) Oral examination before a board; prepare by rehearsing speeches.

Q4. The CFCE is widely regarded as a gold-standard practitioner credential. Which combination explains why? - A) It is a quick multiple-choice exam administered by a tool vendor. - B) It is issued by IACIS and earned through a coached, peer-reviewed practical process followed by an independent practical and a knowledge exam — and it carries ISO 17024 accreditation. - C) It is the cheapest credential in the field and requires no evidence handling. - D) It is granted automatically with EnCase training.

Q5. How is the EnCE earned, and what is the eligibility fork that matters to a working examiner? - A) A single online quiz; eligibility requires a four-year degree only. - B) A Phase I written exam plus a Phase II take-home practical; eligibility requires either authorized EnCase training or documented forensic experience (commonly ~18 months). - C) Attendance at one conference; no exam required. - D) A practical only, with no written component and no experience path.

Q6. Which credential is principally a knowledge exam and therefore sits lowest of these on the practical-versus-knowledge axis? - A) The X-Ways X-PERT. - B) The CFCE. - C) The EC-Council CHFI. - D) The EnCE Phase II practical.

Q7. A paralegal moving into litigation support asks which credentials matter for the eDiscovery path. The correct answer is: - A) GREM and GNFA. - B) EnCE and GCFA. - C) Relativity's RCA and the ACEDS CEDS. - D) PC-3000 and a chip-off course.

Q8. Which statement about data-recovery credentials is accurate? - A) The "Certified Data Recovery Professional" is the field's dominant, court-weighed credential. - B) There is no dominant, broadly-recognized recovery certification; what matters instead is vendor training (PC-3000, DeepSpar, Rusolut, Teel) plus a track record vouched for by other shops. - C) A recovery engineer must hold a CISSP before touching a drive. - D) Recovery is the most heavily certified of the five career paths.

Q9. On the chapter's value pyramid, what sits above certifications — i.e., proves you can do the work more strongly than the letters do? - A) Nothing; certifications are the strongest possible proof. - B) Demonstrated casework and provable hands-on skill (a portfolio, CTF placements, references). - C) Only a formal degree. - D) The number of acronyms after your name.

Q10. Mobile credentials (e.g., Cellebrite's) renew on roughly a two-year cycle — the shortest in the chapter. The best explanation is: - A) Phone vendors lobby for short cycles to sell training. - B) The artifacts move fastest there — phone operating systems and extraction methods change constantly — so currency expires soonest, an administrative expression of theme four. - C) Mobile exams are easier and must be retaken often. - D) Two years is a legal maximum for any certification.

True/False

Q11. Listing a lapsed certification on your CV as though it were current is a minor formatting issue with no real consequence. (True / False)

Q12. ISO/IEC 17024 is the standard under which an independent body accredits a certifying organization's person-certification program (verifying the exam is psychometrically sound and impartial). (True / False)

Short answer

Q13. In two or three sentences, explain why practitioners and courts trust practical exams more than knowledge exams, and what that implies for which credential you should pursue when two otherwise look equal.

Q14. A working examiner let their EnCE lapse two years ago but still lists "EnCE" on the CV they hand to retaining attorneys. Explain in two or three sentences why this is dangerous (connect it to the CV as sworn evidence) and the two honest ways to handle a lapsed credential.

---

Answer key

Q1 — B. The field generally has no license to practice; the market and the courts therefore adopted certification as an imperfect but readable proxy a stranger can use to estimate competence. (A and D are false; C confuses the proxy with permanence — certs typically expire precisely so they signal current competency.)

Q2 — C. A license is government permission to practice (enforceable by law); accreditation applies to organizations — ISO/IEC 17025 for a lab, ISO/IEC 17024 for the certifying body. A and B swap the definitions; D is false (degrees do not expire).

Q3 — B. GIAC exams are proctored but open-book, testing applied judgment under time pressure; the dominant study task is building a custom, alphabetized index so you can find an artifact or command in seconds, which also forces you to read every page actively.

Q4 — B. CFCE comes from IACIS, is earned through a coached peer-review phase plus an independent practical and knowledge exam, and carries ISO 17024 accreditation — the manner of earning (repeated, reviewed casework) is exactly why it is trusted.

Q5 — B. EnCE is a written Phase I plus a take-home practical Phase II, and eligibility can be met by authorized training or documented experience — the experience path lets a working examiner certify without paying for the course.

Q6 — C. CHFI is principally a knowledge-based multiple-choice exam; it sits below CFCE, CCE, EnCE Phase II, and the X-PERT on the practical axis. It is a useful breadth/compliance credential best paired with something hands-on.

Q7 — C. The eDiscovery path runs on Relativity's RCA (platform administration) and the ACEDS CEDS (the EDRM/FRCP process-and-law credential) — not on examiner certs like EnCE or GCFA.

Q8 — B. Recovery has no dominant recognized certification; capability training (PC-3000/ACE Lab, DeepSpar, Rusolut, Teel Technologies) plus a track record is how competence is proven — the least-certified of the five paths.

Q9 — B. Demonstrated casework and provable hands-on skill sit above certifications on the value pyramid; certs are level three, valuable but subordinate, and only just above formal education. A résumé of letters with nothing behind it is the bottom "paper examiner."

Q10 — B. The two-year cycle tracks the fastest-moving artifacts (mobile OS and extraction methods), making renewal an administrative expression of theme four — technology changes, principles don't, so currency expires.

Q11 — False. A lapsed-but-listed credential is an impeachment waiting to happen: opposing counsel produces the expiry, and a jury that catches you exaggerating one line wonders what else you shaded — it can taint your entire testimony. Maintain it or retire it honestly.

Q12 — True. ISO/IEC 17024 (administered in the U.S. through ANAB) accredits bodies that certify persons, verifying the program is psychometrically sound, impartial, and properly maintained — distinct from ISO/IEC 17025, which accredits laboratories.

Q13 — Model answer. A practical exam hands you real evidence and requires you to recover the files, find the artifacts, build the timeline, and reach a defensible conclusion — you cannot cram your way past a drive that will not give up its secrets, so it is the closest a certification gets to watching you work. A knowledge exam can be passed by memorization. Therefore, when two credentials look equal, the hands-on one is worth disproportionately more on a résumé and far more on the witness stand; the difficulty is the point, not a deterrent.

Q14 — Model answer. Your CV is sworn evidence, and every credential on it can and will be checked (Chapter 27); a lapsed cert listed as current is an impeachment opportunity that, once exposed, casts doubt on everything else you testified to. The two honest options are to maintain the credential through renewal, or to retire it from the active CV and, if mentioned at all, state it as historical fact ("EnCE, 2018–2023") that never implies current standing.

Scoring: 13–14 correct — you can read the alphabet soup cold and advise someone on a path; you understand the axes, the families, and the renewal/credibility rule alike. 10–12 — solid; revisit the credential-priorities matrix and the cost/renewal tables. 7–9 — you have the vocabulary but not yet the judgment; re-read "What a certification actually signifies" and "Continuing education and renewal." Below 7 — re-read the chapter and Appendix I before you spend money on a credential or put one on a CV; the cost of getting this wrong is your own money, your study hours, and — if a lapsed line reaches a courtroom — your credibility.