Guidance Software Guidance Software Certifications GD0-100 Questions & Answers

• Question 71:

  By default, what color does EnCase use for the contents of a logical file

  A. Red

  B. Red on black

  C. Black

  D. Black on red

  Correct Answer: C

• Question 72:

  In Windows 2000 and XP, which of the following directories contain user personal folders?

  A. C:\Personnel Folders

  B. C:\WINNT\Profiles

  C. C:\Windows\Users

  D. C:\Documents and Settings

  Correct Answer: D

• Question 73:

  The MD5 hash algorithm produces a _____ number.

  A. 32 bit

  B. 256 bit

  C. 64 bit

  D. 128 bit

  Correct Answer: D

• Question 74:

  An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

  A. can

  B. cannot

  Correct Answer: A

• Question 75:

  Searches and bookmarks are stored in the evidence file.

  A. False

  B. True

  Correct Answer: A

• Question 76:

  The EnCase evidence file is best described as:

  A. A clone of the source hard drive.

  B. A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.

  C. A bit stream image of the source hard drive written to a file, or several file segments.

  D. A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.

  Correct Answer: C

• Question 77:

  4 bits allows what number of possibilities?

  A. 16

  B. 4

  C. 2

  D. 8

  Correct Answer: A

• Question 78:

  If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

  A. EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

  B. EnCase detect the error if the evidence file is manually re-verified.

  C. EnCase will detect the error when that area of the evidence file is accessed by the user.

  D. All of the above.

  Correct Answer: D

• Question 79:

  Creating an image of a hard drive that was seized as evidence:

  A. May be done by anyone because it is a relatively simple procedure.

  B. May only be done by trained personnel because the process has the potential to alter the original evidence.

  C. May only be done by computer scientists.

  D. Should be done by the user, as they are most familiar with the hard drive.

  Correct Answer: B

• Question 80:

  The signature table data is found in which of the following files?

  A. The evidence file

  B. The configuration FileSignatures.ini file

  C. All of the above

  D. The case file

  Correct Answer: B