Setting up a computer forensics lab involves several critical steps that need to be executed in a logical and efficient order. The correct sequence starts with planning and budgeting (2), as it is essential to understand the scope, resources, and financial commitment required for the lab. The next step involves considering the physical location and structural design (1) to ensure the lab meets operational needs and security requirements. Work area considerations (3) follow, focusing on the layout and functionality of the workspace. Human resource considerations (6) are crucial next, to ensure the lab is staffed with qualified personnel. Physical security recommendations (4) are then implemented to protect the lab and its resources. Finally, forensic lab licensing (5) ensures the lab operates within legal and regulatory frameworks.

This scenario focuses on physical forensic evidence preservation, a key concept in the ECIH First Response module. Trace-level indicators such as fingerprints, residues, and physical media can provide attribution in insider investigations.
Option A is correct because Aaron's actions prevent contamination or destruction of physical trace evidence that may later link the incident to a specific individual. ECIH stresses that digital investigations often involve physical evidence, especially in insider cases.
Options B-D focus on digital evidence, which is not the primary concern described here.
Proper preservation of physical trace evidence supports attribution, legal proceedings, and disciplinary action, aligning fully with ECIH forensic readiness principles.

A Distributed Denial of Service (DDoS) attack is a widespread cyber assault in which multiple compromised systems--often geographically distributed--are manipulated to flood a target (such as a server, website, or network) with massive volumes of traffic. The goal is to exhaust the resources of the target system, rendering it slow, unresponsive, or completely unavailable to legitimate users.
The individual machines used in such an attack are commonly referred to as "zombies" (option B). A zombie is a computer or device that has been silently compromised by malware--typically without the knowledge of its legitimate user. Once infected, the device becomes part of a botnet, a network of zombies controlled remotely by an attacker, also known as a bot herder.
These zombie systems lie dormant until activated, often receiving commands to participate in malicious activities such as:
DDoS attacks
Spam email distribution
Data theft

Splunk is a powerful tool for log analysis, capable of collecting, analyzing, and visualizing data from various sources in real time. For an incident handler like Drake, intending to detect traces of malicious activities within the network infrastructure, Splunk can efficiently parse large volumes of log data, enabling the identification of patterns and anomalies that may indicate malware propagation or other security incidents. Its real-time analysis capabilities make it an ideal tool for monitoring network activities and responding to incidents promptly.

The vulnerability exploited by Clark through tampering with form and parameter values to gain unauthorized access to information assets is indicative of Broken Access Control. Broken Access Control vulnerabilities occur when a web application does not properly enforce restrictions on what authenticated users are allowed to do. Attackers can exploit these vulnerabilities to access unauthorized functionality or data, such as accessing other users' accounts, viewing sensitive files, and modifying other users' data.