Cisco
210-255 · Question #162
210-255 Question #162: Real Exam Question with Answer & Explanation
The correct answer is D: indirect evidence. The video correlates two separate facts - a suspect's presence and a file transfer - to imply guilt through inference rather than directly capturing the act, making it indirect (circumstantial) evidence.
Question
You have a video of a suspect entering a data center that was captured on the same that files in the same data center were transferred to a computer. Which type of is this?
Options
- APhysical evidence
- Bbest evidence
- Cprima faice evidence
- Dindirect evidence
Explanation
The video correlates two separate facts - a suspect's presence and a file transfer - to imply guilt through inference rather than directly capturing the act, making it indirect (circumstantial) evidence.
Common mistakes.
- A. Physical evidence refers to tangible objects directly tied to a crime, such as a USB drive containing stolen files, not video correlation of separate events.
- B. Best evidence describes the original, unaltered form of a document or recording submitted as the primary source; it is a classification of evidence quality, not the inferential nature of the proof.
- C. Prima facie evidence is sufficient on its face to establish a fact without additional inference; placing a suspect at a scene at the same time as a crime does not on its own directly prove they committed the act.
Concept tested. Indirect vs direct evidence in digital forensics
Community Discussion
No community discussion yet for this question.