Guidance Software Guidance Software Certification GD0-110 Questions & Answers

• Question 1:

  The EnCase signature analysis is used to perform which of the following actions?

  A. Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.

  B. Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.

  C. Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.

  Correct Answer: A

• Question 2:

  EnCase can make an image of a USB flash drive.

  A. True

  B. False

  Correct Answer: B

• Question 3:

  How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

  A. The .case file writes a CRC value for the case information and verifies it when the case is opened.

  B. EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

  C. EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

  D. EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

  Correct Answer: C

• Question 4:

  Which of the following is commonly used to encode e-mail attachments?

  A. GIF

  B. EMF

  C. JPEG

  D. Base64

  Correct Answer: D

• Question 5:

  A signature analysis has been run on a case. The result *JPEG in the signature column means:

  A. The file signature is unknown and the file extension is JPEG.

  B. The file signature is unknown and the header is a JPEG.

  C. The file signature is a JPEG signature and the file extension is incorrect.

  D. None of the above.

  Correct Answer: C

• Question 6:

  When a file is deleted in the FAT or NTFS file systems, what happens to the data on the hard drive?

  A. The file header is marked with a Sigma so the file is not recognized by the operating system.

  B. It is moved to a special area.

  C. It is overwritten with zeroes.

  D. Nothing.

  Correct Answer: D

• Question 7:

  Pressing the power button on a computer that is running could have which of the following results?

  A. The operating system will shut down normally.

  B. The computer will instantly shut off.

  C. Nothing will happen.

  D. All of the above could happen.

  E. The computer will go into stand-by mode.

  Correct Answer: D

• Question 8:

  Select the appropriate name for the highlighted area of the binary numbers.

  A. Nibble

  B. Dword

  C. Word

  D. Byte

  E. Bit

  Correct Answer: D

• Question 9:

  If cluster #3552 entry in the FAT table contains a value of this would mean:

  A. The cluster is allocated

  B. The cluster is marked bad

  C. The cluster is unallocated

  D. The cluster is the end of a file

  Correct Answer: C

• Question 10:

  In Windows 2000 and XP, which of the following directories contain user personal folders?

  A. C:\WINNT\Profiles

  B. C:\Documents and Settings

  C. C:\Windows\Users

  D. C:\Personnel Folders

  Correct Answer: B