AccessData A30-327 Online Practice Questions and Exam Preparation

AccessData A30-327 Online Questions & Answers

• Question 1:

  Which file should be selected to open an existing case in FTK?

  A. ftk.exe
  B. case.ini
  C. case.dat
  D. isobuster.dll
  C. case.dat

• Question 2:

  You currently store alternate hash libraries on a remote server.

  Where do you configure FTK to access these files rather than the default library, ADKFFLibrary.hdb?

  A. Preferences
  B. User Options
  C. Analysis Tools
  D. Import KFF Hashes
  A. Preferences

• Question 3:

  What happens when a duplicate hash value is imported into a KFF database?

  A. It will not be accepted.
  B. It will be marked as a duplicate.
  C. The database will be corrupted.
  D. The database will hide the duplicate.
  A. It will not be accepted.

• Question 4:

  Into which two categories can an imported hash set be assigned? (Choose two.)

  A. alert
  B. ignore
  C. contraband
  D. system files
  A. alert
  B. ignore

• Question 5:

  FTK Imager can be invoked from within which program?

  A. FTK
  B. DNA
  C. PRTK
  D. Registry Viewer
  A. FTK

• Question 6:

  Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

  A. list SAM file account names in FTK
  B. view all registry files from within FTK
  C. createsubitems of individual keys for FTK
  D. export a registry report to the FTK case report
  B. view all registry files from within FTK
  D. export a registry report to the FTK case report

• Question 7:

  Click the Exhibit button.

  

  When decrypting EFS files in a case, you receive the result shown in the exhibit. What is the most plausible explanation for this result?

  A. The encrypted file was corrupt.
  B. A different user encrypted the remaining encrypted file.
  C. The hash value of the remaining encrypted file did not match.
  D. The remaining encrypted file had previously been bookmarked.
  E. An incorrect CRC value for the $EFS certificate was applied by the user.
  B. A different user encrypted the remaining encrypted file.

• Question 8:

  Which two statements are true? (Choose two.)

  A. PRTK can recover Windows logon passwords.
  B. PRTK must run in conjunction with DNA workers to decrypt EFS files.
  C. PRTK and FTK must be installed on the same machine to decrypt EFS files.
  D. EFS files must be exported from a case and provided to PRTK for decryption.
  A. PRTK can recover Windows logon passwords.
  C. PRTK and FTK must be installed on the same machine to decrypt EFS files.

• Question 9:

  After creating a case, the Encrypted Files container lists EFS files. However, no decrypted sub- items are present. All other necessary components for EFS decryption are present in the case. Which two files must be used to recover the EFS password for use in FTK? (Choose two.)

  A. SAM
  B. system
  C. SECURITY
  D. Master Key
  E. FEK Certificate
  A. SAM
  B. system

• Question 10:

  In FTK, a user may alter the alert or ignore status of individual hash sets within the active KFF. Which utility is used to accomplish this?

  A. KFF Alert Editor
  B. ADKFF Library Selector
  C. Hash Database File Selector
  D. Hash Database Recovery Engine
  A. KFF Alert Editor