AccessData A30-327 Online Practice Questions and Exam Preparation

AccessData A30-327 Online Questions & Answers

• Question 41:

  In Registry Viewer, which steps initiate the Hex Interpreter?

  A. highlight the data and select the Hex Value Interpreter tab
  B. highlight the data, right-click on the highlighted data and select the Show Hex Interpreter Window
  C. select the Hex Value Interpreter tab, highlight the data, right-click on the data to initiate the Hex Interpreter
  D. right-click on the data area and select the Show Hex Interpreter Window and highlight the data you want to interpret
  B. highlight the data, right-click on the highlighted data and select the Show Hex Interpreter Window

• Question 42:

  You currently store alternate hash libraries on a remote server.

  Where do you configure FTK to access these files rather than the default library, ADKFFLibrary.hdb?

  A. Preferences
  B. User Options
  C. Analysis Tools
  D. Import KFF Hashes
  A. Preferences

• Question 43:

  In FTK, when you view the Total File Items container (rather than the Actual Files container), why are there more items than files?

  A. Total File Items includes files that are in archive files, while Actual Files does not.
  B. Total File Items includes all unfiltered files while Actual Files includes only checked files.
  C. Total File Items includes all KFFIgnorables while Actual Files includes only the KFF Alerts.
  D. Total File Items includes files that are in the Graphics and E-Mail tabs, while Actual Files only includes files in the Graphics tab while excluding attachments in the E-mail tab.
  A. Total File Items includes files that are in archive files, while Actual Files does not.

• Question 44:

  During the execution of a search warrant, you image a suspect drive using FTK Imager and store the Raw(dd) image files on a portable drive. Later, these files are transferred to a server for storage. How do you verify that the information stored on the server is unaltered?

  A. open and view the Summary file
  B. load the image into FTK and it automatically performs file verification
  C. in FTK Imager, use the Verify Drive/Image function to automatically compare a calculated hash with a stored hash
  D. use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file
  D. use FTK Imager to create a verification hash and manually compare that value to the value stored in the Summary file

• Question 45:

  Which Registry Viewer function would allow you to automatically document multiple unknown user names?

  A. Add to Report
  B. Export User List
  C. Add to Report with Children
  D. Summary Report with Wildcard
  D. Summary Report with Wildcard

• Question 46:

  Which data in the Registry can the Registry Viewer translate for the user? (Choose three.)

  A. calculate MD5 hashes of individual keys
  B. translate the MRUs in chronological order
  C. present data stored in null terminated keys
  D. present the date and time of each typed URL
  E. View Protected Storage System Provider (PSSP) data
  B. translate the MRUs in chronological order
  C. present data stored in null terminated keys
  E. View Protected Storage System Provider (PSSP) data

• Question 47:

  In which Overview tab container are HTML files classified?

  A. Archive container
  B. Java Code container
  C. Documents container
  D. Internet Files container
  C. Documents container

• Question 48:

  To obtain protected files on a live machine with FTK Imager, which evidence item should be added?

  A. image file
  B. currently booted drive
  C. server object settings
  D. profile access control list
  B. currently booted drive

• Question 49:

  Into which two categories can an imported hash set be assigned? (Choose two.)

  A. alert
  B. ignore
  C. contraband
  D. system files
  A. alert
  B. ignore

• Question 50:

  FTK uses Data Carving to find which three file types? (Choose three.)

  A. JPEG files
  B. Yahoo! Chat Archives
  C. WPD (Word Perfect Documents)
  D. Enhanced WindowsMeta Files (EMF)
  E. OLE Archive Files (Office Documents)
  A. JPEG files
  D. Enhanced WindowsMeta Files (EMF)
  E. OLE Archive Files (Office Documents)