AccessData A30-327 Online Practice Questions and Exam Preparation

AccessData A30-327 Online Questions & Answers

• Question 21:

  Click the Exhibit button.

  

  What change do you make to the file filter shown in the exhibit in order to show only graphics with a logical size between 500 kilobytes and 10 megabytes?

  A. You change all file status items to a red circle.
  B. You change all file status items to a yellow triangle.
  C. You make no change. The filter is correct as shown.
  D. You change Graphics in the File Type column to a yellow triangle.
  D. You change Graphics in the File Type column to a yellow triangle.

• Question 22:

  Which statement is true about using FTK Imager to simultaneously create multiple images of a single source?

  A. In the Image Creation Wizard, you should select the Add Additional Drives option.
  B. You should use the Create Multiple Images option to create server image objects.
  C. You should note the evidence item source signature and add it to the Image View pane.
  D. In the Image Creation Wizard, you should add multiple destination jobs from the same source prior To beginning image creation.
  D. In the Image Creation Wizard, you should add multiple destination jobs from the same source prior To beginning image creation.

• Question 23:

  You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

  A. MD5
  B. SHA1
  C. filename
  D. record date
  E. date modified
  A. MD5
  B. SHA1
  C. filename

• Question 24:

  In PRTK, which type of attack uses word lists?

  A. dictionary attack
  B. key space attack
  C. brute-force attack
  D. rainbow table attack
  A. dictionary attack

• Question 25:

  You are attempting to access data from the Protected Storage System Provider (PSSP) area of a registry. How do you accomplish this using PRTK?

  A. You drop the SAM file onto the PRTK interface.
  B. You drop the NTUSER.dat file onto the PRTK interface.
  C. You use the PSSP Attack Marshal from Registry Viewer.
  D. This area can not be accessed with PRTK as it is a registry file.
  B. You drop the NTUSER.dat file onto the PRTK interface.

• Question 26:

  What happens when a duplicate hash value is imported into a KFF database?

  A. It will not be accepted.
  B. It will be marked as a duplicate.
  C. The database will be corrupted.
  D. The database will hide the duplicate.
  A. It will not be accepted.

• Question 27:

  You view a registry file in Registry Viewer. You want to create a report, which includes items that you have marked "Add to Report." Which Registry Viewer option accomplishes this task?

  A. Common Areas
  B. Generate Report
  C. Define Summary Report
  D. Manage Summary Reports
  B. Generate Report

• Question 28:

  Which statement is true about using FTK Imager to export a folder and its subfolders?

  A. Exporting a folder will copy all its subfolders.
  B. Each subfolder must be exported individually.
  C. Exporting a folder copies only the folder without any files.
  D. Exporting a folder will copy all subfolders without the system attribute.
  A. Exporting a folder will copy all its subfolders.

• Question 29:

  After creating a case, the Encrypted Files container lists EFS files. However, no decrypted sub- items are present. All other necessary components for EFS decryption are present in the case. Which two files must be used to recover the EFS password for use in FTK? (Choose two.)

  A. SAM
  B. system
  C. SECURITY
  D. Master Key
  E. FEK Certificate
  A. SAM
  B. system

• Question 30:

  Which three items are displayed in FTK Imager for an individual file in the Properties window? (Choose three.)

  A. flags
  B. filename
  C. hash set
  D. timestamps
  E. item number
  A. flags
  B. filename
  D. timestamps