Guidance Software Guidance Software Certifications GD0-100 Questions & Answers

• Question 131:

  The EnCase case file can be best described as:

  A. The file that runs EnCase for Windows.

  B. A filecontain configuration settings for cases.

  C. None of the above.

  D. A file that contains information specific to one case.

  Correct Answer: D

• Question 132:

  Before utilizing an analysis technique on computer evidence, the investigator should:

  A. Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.

  B. Be trained in the employment of the technique.

  C. Botha and b.

  D. Neithera or b.

  Correct Answer: C

• Question 133:

  Consider the following path in a FAT file system:

  A. From the My Pictures directory

  B. From the My Documents directory

  C. From the root directory c:\

  D. From itself

  Correct Answer: A

• Question 134:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Word

  B. Byte

  C. Bit

  D. Nibble

  E. Dword

  Correct Answer: B

• Question 135:

  The maximum file segment size for an EnCase evidence file is:

  A. 1500 MB

  B. 1000 MB

  C. 2000 MB

  D. There is no limit.

  E. 500 MB

  Correct Answer: C

• Question 136:

  When a file is deleted in the FAT file system, what happens to the FAT?

  A. The FAT entries for that file are marked as allocated.

  B. Nothing.

  C. It is deleted as well.

  D. The FAT entries for that file are marked as available.

  Correct Answer: D

• Question 137:

  Which of the following statements is more accurate?

  A. The Recycle Bin increases the chance of locating the existence of a file on a computer.

  B. The Recycle Bin reduces the chance of locating the existence of a file on a computer.

  Correct Answer: A

• Question 138:

  A file extension and signature can be manually added by:

  A. Using the new library feature under hash libraries.

  B. Right-clicking on a file and selecting dd.?

  C. Using the new set feature under hash sets.

  D. Using the new file signature feature under file signatures.

  Correct Answer: D

• Question 139:

  Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

  A. Pull the plug from the back of the computer.

  B. Press the power button and hold it in.

  C. Shut it down normally.

  D. Pull the plug from the wall.

  Correct Answer: C

• Question 140:

  Temp files created by EnCase are deleted when EnCase is properly closed.

  A. True

  B. False

  Correct Answer: A