Black Friday Special Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: mxmas70

 
Home > Guidance Software > EnCE > GD0-110

GD0-110 Certification Exam for EnCE Outside North America Question and Answers

Question # 4

The EnCase default export folder is:

A.

A global setting that can be changed.

B.

A case-specific setting that can be changed.

C.

A global setting that cannot be changed.

D.

A case-specific setting that cannot be changed.

Full Access
Question # 5

Which of the following directories contain the information that is found on a Windows 98 Desktop?

A.

C:\Windows\Desktop

B.

C:\Desktop

C.

C:\Program files\Programs\Desktop

D.

C:\Startup\Desktop\Items

Full Access
Question # 6

By default, what color does EnCase use for slack?

A.

Black

B.

Red

C.

Black on red

D.

Red on black

Full Access
Question # 7

In the EnCase environment, the term uxternal viewers is best described as:

A.

Programs that are exported out of an evidence file.

B.

Programs that are associated with EnCase to open specific file types.

C.

Any program that is loaded on the lab hard drive.

D.

Any program that will work with EnCase.

Full Access
Question # 8

The signature table data is found in which of the following files?

A.

The case file

B.

The configuration FileSignatures.ini file

C.

The evidence file

D.

All of the above

Full Access
Question # 9

How many partitions can be found in the boot partition table found at the beginning of the drive?

A.

2

B.

4

C.

6

D.

8

Full Access
Question # 10

You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:

A.

Record the location that the computer was recovered from.

B.

Record the identity of the person(s) involved in the seizure.

C.

Record the date and time the computer was seized.

D.

Record nothing to avoid inaccuracies that might jeopardize the use of the evidence.

Full Access
Question # 11

The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

A.

Tomorrow

B.

Tom

C.

Stomp

D.

TomJ@hotmail.com

Full Access
Question # 12

Before utilizing an analysis technique on computer evidence, the investigator should:

A.

Be trained in the employment of the technique.

B.

Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.

C.

Both a and b.

D.

Neither a or b.

Full Access
Question # 13

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

A.

800.555.1212

B.

8005551212

C.

800-555 1212

D.

(800) 555-1212

Full Access
Question # 14

If a hash analysis is run on a case, EnCase:

A.

Will compute a hash value of the evidence file and begin a verification process.

B.

Will generate a hash set for every file in the case.

C.

Will compare the hash value of the files in the case to the hash library.

D.

Will create a hash set to the user specifications.

Full Access
Question # 15

The EnCase methodology dictates that the lab drive for evidence have a __________ prior to making an image.

A.

unique volume label

B.

FAT 16 partition

C.

NTFS partition

D.

bare, unused partition

Full Access
Question # 16

The term signature and header as they relate to a signature analysis are:

A.

Areas compared with each other to verify the correct file type.

B.

Synonymous.

C.

The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.

D.

None of the above

Full Access
Question # 17

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

A.

C X H X S

B.

C X H + S

C.

C X H X S + 512

D.

C X H X S X 512

Full Access
Question # 18

RAM is an acronym for:

A.

Random Access Memory

B.

Relative Address Memory

C.

Random Addressable Memory

D.

Relative Addressable Memory

Full Access
Question # 19

Which statement would most accurately describe a motherboard?

A.

An add-in card that controls all hard drive activity.

B.

An add-in card that handles all RAM.

C.

The main circuit board that has slots for the microprocessor, RAM, ROM, and add-in cards.

D.

Any circuit board, regardless of its function.

Full Access
Question # 20

In Windows 98 and ME, Internet based e-mail, such as Hotmail, will most likely be recovered in the _____________________ folder.

A.

C:\Windows\Temp

B.

C:\Windows\Temporary Internet files

C.

C:\Windows\History\Email

D.

C:\Windows\Online\Applications\email

Full Access
Question # 21

Which of the following selections is NOT found in the case file?

A.

External viewers

B.

Pointers to evidence files

C.

Signature analysis results

D.

Search results

Full Access
Question # 22

The EnCase case file can be best described as:

A.

The file that runs EnCase for Windows.

B.

A file contain configuration settings for cases.

C.

A file that contains information specific to one case.

D.

None of the above.

Full Access
Question # 23

A standard Windows 98 boot disk is acceptable for booting a suspect drive.

A.

True

B.

False

Full Access
Question # 24

The FAT in the File Allocation Table file system keeps track of:

A.

File fragmentation

B.

Every addressable cluster on the partition

C.

Clusters marked as bad

D.

All of the above.

Full Access
Question # 25

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename C:\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename C:\downloads\chk1.dll with the starting extent 0C4057, which EnCase also shows as being moved. In the C:\windows\System folder you find an allocated file named chk1.dll with the starting extent 0C4057. The chk1.dll file is a JPEG image of a counterfeit check. Could this information be used to refute the suspect claim that he never knew it was on the computer?

A.

Yes, because the chk1.dll file was moved and renamed.

B.

No, because the Windows operating system likely moved and renamed the chk1.dll file during disk maintenance.

C.

No, because the chk1.dll file has no evidentiary value.

D.

Yes, because the ch1.dll is all the evidence required to prove the case.

Full Access
Question # 26

A physical file size is:

A.

The total size in bytes of a logical file.

B.

The total size in sectors of an allocated file.

C.

The total size of all the clusters used by the file measured in bytes.

D.

The total size of the file including the ram slack in bytes.

Full Access
Copyright myexamcollection.com. All Right Reserved.