Guidance Software Guidance Software Certification GD0-100 Questions & Answers

• Question 171:

  EnCase uses the _________________ to conduct a signature analysis.

  A. Both a and b

  B. file signature table

  C. hash library

  D. file Viewers

  Correct Answer: B

• Question 172:

  Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

  A. C X H + S

  B. C X H X S + 512

  C. C X H X S X 512

  D. C X H X S

  Correct Answer: C

• Question 173:

  Hash libraries are commonly used to:

  A. Compare a file header to a file extension.

  B. Identify files that are already known to the user.

  C. Compare one hash set with another hash set.

  D. Verify the evidence file.

  Correct Answer: B

• Question 174:

  The default export folder remains the same for all cases.

  A. True

  B. False

  Correct Answer: B

• Question 175:

  The EnCase default export folder is:

  A. A case-specific setting that cannot be changed.

  B. A case-specific setting that can be changed.

  C. A global setting that can be changed.

  D. A global setting that cannot be changed.

  Correct Answer: B

• Question 176:

  The acronym ASCII stands for:

  A. American Standard Communication Information Index

  B. American Standard Code for Information Interchange

  C. Accepted Standard Code for Information Interchange

  D. Accepted Standard Communication Information Index

  Correct Answer: B

• Question 177:

  How are the results of a signature analysis examined?

  A. By sorting on the category column in the Table view. By sorting on the category column in the Table view.

  B. By sorting on the signature column in the Table view. By sorting on the signature column in the Table view.

  C. By sorting on the hash sets column in the Table view. By sorting on the hash sets column in the Table view.

  D. By sorting on the hash library column in the Table view. By sorting on the hash library column in the Table view.

  Correct Answer: B

• Question 178:

  If cluster number 10 in the FAT contains the number 55, this means:

  A. That cluster 10 is used and the file continues in cluster number 55.

  B. That the file starts in cluster number 55 and continues to cluster number 10.

  C. That there is a cross-linked file.

  D. The cluster number 55 is the end of an allocated file.

  Correct Answer: A

• Question 179:

  In Unicode, one printed character is composed of ____ bytes of data.

  A. 8

  B. 4

  C. 2

  D. 1

  Correct Answer: C

• Question 180:

  A physical file size is:

  A. The total size in sectors of an allocated file.

  B. The total size of all the clusters used by the file measured in bytes.

  C. The total size in bytes of a logical file.

  D. The total size of the file including the ram slack in bytes.

  Correct Answer: B