最新的Guidance Software GD0-110免費考試真題

問題1

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

A. Neither a or b

B. The .SHD file

C. Both a and b

D. The .SPL file

正確答案: C

問題2

CORRECT TEXT
If a floppy diskette is in the ?drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the ??drive, the computer will always boot to that drive before any other device.

A. False

B. True

正確答案: B

問題3

A hard drive was imaged using EnCase. The original drive was placed into evidence. The restore feature was used to make a copy of the original hard drive. EnCase verifies the restored copy using:

A. An MD5 hash

B. A 32 bit CRC

C. A running log

D. Nothing. Restored volumes are not verified.

正確答案: A

問題4

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

A. The acquisition notes

B. None of the above

C. The investigator name The investigator? name

D. The evidence number

正確答案: B

問題5

A suspect typed a file on his computer and saved it to a floppy diskette. The filename was MyNote.txt. You receive the floppy and the suspect computer. The suspect denies that the floppy disk belongs to him. You search the suspect computer and locate only the suspect? computer. The suspect denies that the floppy disk belongs to him. You search the suspect? computer and locate only the filename within a .LNK file. The .LNK file is located in the folder C:\Windows\Recent. How you would use the .LNK file to establish a connection between the file on the floppy diskette and the suspect computer? connection between the file on the floppy diskette and the suspect? computer?

A. The full path of the file, found in the .LNK file

B. Both a and b

C. The dates and time of the file found in the .LNK file, at file offset 28

D. The file signature found in the .LNK file

正確答案: B

問題6

A hard drive has 8 sectors per cluster. File Mystuff.doc has a logical file size of 13,000 bytes. How many clusters will be used by Mystuff.doc?

A. 3

B. 4

C. 2

D. 1

正確答案: B

問題7

CORRECT TEXT
An evidence file can be moved to another directory without changing the file verification.

A. False

B. True

正確答案: B

問題8

An Enhanced Metafile would best be described as:

A. A graphics file attached to an e-mail message.

B. A compressed zip file.

C. A compound e-mail attachment.

D. A file format used in the printing process by Windows.

正確答案: D

問題9

Within EnCase, what is purpose of the default export folder?

A. This is the folder used to hold copies of files that are sent to external viewers.

B. This is the folder that will be automatically selected when the copy/unerase feature is used.

C. This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

D. This is the folder that temporarily stores all bookmark and search results.

正確答案: B

問題10

Hash libraries are commonly used to:

A. Compare one hash set with another hash set.

B. Identify files that are already known to the user.

C. Compare a file header to a file extension.

D. Verify the evidence file.

正確答案: B

問題11

By default, what color does EnCase use for slack?

A. Black on red

B. Red on black

C. Black

D. Red

正確答案: D

最新的Guidance Software Certification Exam for EnCE Outside North America - GD0-110免費考試真題

聯系我們

站內鏈接

最新更新