AccessData A30-327 Online Practice Questions and Exam Preparation

AccessData A30-327 Online Questions & Answers

• Question 11:

  You are using FTK to process e-mail files. In which two areas can E-mail attachments be located? (Choose two.)

  A. the E-mail tab
  B. the From E-mail container in the Overview tab
  C. the Evidence Items container in the Overview tab
  D. the E-mail Messages container in the Overview tab
  A. the E-mail tab
  B. the From E-mail container in the Overview tab

• Question 12:

  When using PRTK to attack encrypted files exported from a case, which statement is true?

  A. PRTK will request the user access control list from FTK.
  B. PRTK will generate temporary copies of decrypted files for printing.
  C. FTK will stop all active jobs to allow PRTK to decrypt the exported files.
  D. File hash values will change when they are saved in their decrypted format.
  E. Additional interoperability between PRTK andNTAccess becomes available when files begin decrypting.
  D. File hash values will change when they are saved in their decrypted format.

• Question 13:

  Using the FTK Report Wizard, which two options are available in the Bookmarks - A window? (Choose two.)

  A. Apply a filter to the list
  B. Group all filenames at end of report
  C. Yes, include all graphics in the case
  D. No, do not include a bookmark section
  E. Export full-size graphics and link them to the thumbnails
  D. No, do not include a bookmark section
  E. Export full-size graphics and link them to the thumbnails

• Question 14:

  What is the most effective method to facilitate successful password recovery?

  A. Art of War
  B. Entropy Test
  C. Advanced EFS Attack
  D. Primary Dictionary Attack
  A. Art of War

• Question 15:

  Which two statements are true? (Choose two.)

  A. PRTK can recover Windows logon passwords.
  B. PRTK must run in conjunction with DNA workers to decrypt EFS files.
  C. PRTK and FTK must be installed on the same machine to decrypt EFS files.
  D. EFS files must be exported from a case and provided to PRTK for decryption.
  A. PRTK can recover Windows logon passwords.
  C. PRTK and FTK must be installed on the same machine to decrypt EFS files.

• Question 16:

  You used FTK Imager to create several hash list files. You view the location where the files were exported. What is the file extension type for these files?

  A. .txt = ASCII Text File
  B. .dif = Data Interchange Format
  C. .prn = Formatted Text Delimited
  D. .csv = Comma Separated Values
  D. .csv = Comma Separated Values

• Question 17:

  Click the Exhibit button.

  

  You need to search for specific data that are located in a Microsoft Word document. You do not know the exact spelling of this datA. Using the Index Search Options as displayed in the exhibit, which changes do you make in the Broadening Options and Search Limiting Options containers?

  A. check the Fuzzy box;check the File Name Pattern box; type *.doc in the pattern container
  B. check the Stemming box; check the File Name Pattern box; type *.doc in the pattern container
  C. check the Synonym box;check the File Name Pattern box; type *.doc in the pattern container
  D. check the Stemming box; check the File Name Pattern box;type %.doc in the pattern container
  A. check the Fuzzy box;check the File Name Pattern box; type *.doc in the pattern container

• Question 18:

  Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

  A. list SAM file account names in FTK
  B. view all registry files from within FTK
  C. createsubitems of individual keys for FTK
  D. export a registry report to the FTK case report
  B. view all registry files from within FTK
  D. export a registry report to the FTK case report

• Question 19:

  What are three image file formats that can be read by FTK Imager? (Choose three.)

  A. E01 files
  B. raw (dd) image files
  C. SafeBack version 2.2 image files
  D. SafeBack version 3.0 image files
  E. Symantec Ghost compressed image files
  A. E01 files
  B. raw (dd) image files
  C. SafeBack version 2.2 image files

• Question 20:

  Which file should be selected to open an existing case in FTK?

  A. ftk.exe
  B. case.ini
  C. case.dat
  D. isobuster.dll
  C. case.dat