Chapter 40 — Quiz

14 questions: 10 multiple choice, 2 true/false, 2 short answer. Answers and a scoring band at the bottom. Commit to an answer before you look — it is the last quiz in the book, so make it honest.

Multiple choice

Q1. What is the central organizing fact of the field's career structure? - A) Each sector requires a completely different skill set, so professionals rarely move between them. - B) One shared ~70% core skill set — imaging, file systems, carving, artifacts, timeline, hashing, documentation — is portable across five very different sectors. - C) Only law enforcement performs real forensics; everything else is IT support. - D) The skills are so specialized that a career-changer cannot enter after age thirty.

Q2. Which career is described as "almost never an entry point," typically earned over a decade in the other sectors first? - A) Corporate incident-response analyst. - B) Data-recovery technician. - C) Independent expert witness. - D) eDiscovery specialist.

Q3. A separating service member often brings which advantage the chapter calls "decisive" for federal and cleared-contractor work? - A) A finished bachelor's degree in computer science. - B) An active security clearance (Secret, Top Secret, or TS/SCI) that is expensive and slow for an employer to sponsor from scratch. - C) A guaranteed federal job offer. - D) Exemption from certification requirements.

Q4. Why are the U.S. Bureau of Labor Statistics figures an imprecise guide to forensic pay? - A) The BLS does not collect any wage data on technology jobs. - B) The work is split across two ill-fitting codes — "Information Security Analysts" (much corporate/consulting work) and "Forensic Science Technicians" (dominated by physical forensics) — and neither captures the field cleanly. - C) Forensic salaries are classified for national-security reasons. - D) Everyone in the field is self-employed, so no wages are reported.

Q5. According to the chapter, which sector tends to pay the most cash, especially at senior levels? - A) Public-sector crime labs. - B) Consulting and corporate incident response. - C) eDiscovery vendors at the entry level. - D) Independent recovery benches.

Q6. The career ladder forks after the senior/lead rung. What are the two tracks? - A) Government track and private track. - B) Recovery track and forensics track. - C) The individual-contributor (IC) track — principal/fellow/expert witness — and the management track — lab director/DFIR manager/practice partner/CISO. - D) Full-time track and contractor track.

Q7. The chapter calls drifting onto the management track "the classic career mistake." Why? - A) Management always pays less than individual-contributor roles. - B) Talented examiners take the management rung because that is where the next raise lived, then discover they miss the keyboard and resent doing work they no longer do. - C) Managers are legally barred from testifying. - D) The IC track is the only honorable path.

Q8. Past the mid-level, what does advancement primarily depend on? - A) Collecting as many certifications as possible. - B) Reputation, built from relentless defensible work, specialization into scarcity, public contribution, and an honest record. - C) The single highest salary offer you can find. - D) Avoiding the courtroom entirely.

Q9. Which best states the chapter's "scarcity beats hours" lesson about pay? - A) Working more billable hours is always the fastest route to higher pay. - B) Generalists are paid for hours; specialists are paid for scarcity, so specialization-plus-credibility is the biggest lever you control. - C) Only a management title raises your compensation. - D) Geography is irrelevant to pay.

Q10. Which of these is a technical exposure-reduction measure that also protects evidence integrity, letting an examiner flag known illicit material without viewing it? - A) Working longer shifts to clear the backlog faster. - B) Hash-set triage and PhotoDNA matching (with NSRL exclusion to discard known-good files). - C) Powering off the suspect machine immediately. - D) Quoting a flat fee before evaluation.

True/False

Q11. The management track is the only real way to advance and earn more in digital forensics; the individual-contributor path is a dead end. (True / False)

Q12. Secondary traumatic stress and compassion fatigue are signs of personal weakness that a sufficiently tough examiner will not experience. (True / False)

Short answer

Q13. In two or three sentences, explain why the chapter says protecting your own sustainability "is not self-indulgence; it is part of your duty to the work" — including what happens to the quality of the work when an examiner burns out.

Q14. A lapsed certification still listed on your CV is described as "a cross-examiner's gift and an ethics violation rolled into one." Explain, in two or three sentences, why — and what habit prevents it.

---

Answer key

Q1 — B. The portable ~70% core (imaging, file systems, carving, OS artifacts, timeline, hashing, documentation, deleted ≠ destroyed) is the reason a single professional can move among five sectors across a career; the bytes do not care which door you came in through.

Q2 — C. The independent expert witness lives or dies on a CV that survives a Daubert challenge — years of cases, recognized certifications, a track record of testimony — which is why it is the autonomy endpoint of the field, earned after a decade, not an entry point.

Q3 — B. An active clearance is expensive and slow to sponsor, so a service member who exits with hands-on DFIR experience and a clearance holds a powerful key to federal and cleared-contractor roles, often with a pay premium of its own.

Q4 — B. Much corporate and consulting work is filed under Information Security Analysts (median well above $120k in the mid-2020s) while crime-lab examiners are lumped under Forensic Science Technicians (a physical-forensics-dominated category with a much lower median); neither code is a clean "digital forensic examiner."

Q5 — B. Consulting and corporate IR pay the most cash, especially at senior levels, because the private sector competes hard for breach-response talent and the supply is thin.

Q6 — C. The fork is genuine — the IC track (principal/fellow/distinguished/expert witness) where you go deeper and become the authority, versus the management track (lab director/DFIR manager/practice partner/CISO) where you run the people who do the cases.

Q7 — B. People drift into management because it was the only way the next raise was offered, then find themselves doing budget spreadsheets and personnel disputes while missing the work they got into the field for; the fix is to choose the fork deliberately and to make the IC track a real, well-paid destination.

Q8 — B. Certifications get you in the door and keep your knowledge current; what makes a prosecutor request you by name or a Fortune 500 call at 2 a.m. is reputation — defensible work, specialization, public contribution, and an honest, content-free record kept like a chain of custody.

Q9 — B. Generalist competence is table stakes; recognized depth in an underserved niche prices you out of the commodity market, which is why specialization-plus-credibility — not raw hours — is the biggest lever on pay.

Q10 — B. Hash-set triage and PhotoDNA surface known material by hash rather than by eye, and NSRL exclusion discards known-good files; every image flagged without being viewed is both better evidence handling and exposure the examiner never absorbed.

Q11 — False. The fork is two different jobs, not two amounts of the same job; the IC/principal/expert-witness track is a real destination, and a mature field makes it well-paid so the only way up is not out of the work you got into the field for.

Q12 — False. They are the predictable, normal injury of a healthy nervous system to abnormal input — an occupational hazard to be managed with technical, organizational, and personal measures from day one, not a character flaw to be hidden behind "I can handle it," which the chapter calls the sentence that precedes the collapse.

Q13 — Model answer. An exhausted, numbed, traumatized examiner makes mistakes — misses artifacts, cuts corners, and loses the objectivity the whole field rests on — so a career built to last is also a career that stays good. Protecting your sustainability therefore protects the truth-serving quality of the work itself, which is why it is a professional duty, and (if you reach the management fork) a duty you owe the people under you as surely as you owe a chain of custody.

Q14 — Model answer. A credential you keep claiming after it expired is a small but real misrepresentation, and once a hostile attorney exposes one untruth under oath a jury may disbelieve everything else you say — so it is simultaneously an ethics violation and a gift to cross-examination. The habit that prevents it is treating your own record like a case: track CPE and renewal dates contemporaneously (run the credential tracker), and claim only what is current and provable.

Scoring: 13–14 correct — you can see the whole board: sectors, doors, pay, the ladder fork, reputation, and sustainability. You are ready to write the career plan and go to work. 10–12 — strong; revisit "What it pays" and "Climbing: from junior examiner to lab director" so the compensation shape and the IC/management fork are second nature. 7–9 — you have the map but not yet the judgment; re-read "The work that lasts" and "Building expertise and reputation," because the sustainability and reputation material is where careers are actually won or lost. Below 7 — re-read the chapter before you make a career decision on the strength of a salary number; in this field the things a salary table omits — mission, the fork, scarcity, and whether the work is survivable — are usually the things that decide whether you are still doing it, intact, at fifty.