Skip to main content

GD0-100 Real Exam Questions

Certification For ENCE North America

185 questions available · Page 1 of 19

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

A signature analysis has been run on a case. The result "Bad Signature " means:

  1. A

    The file signature is known and does not match a known file header.

  2. B

    The file signature is known and the file extension is known.

  3. C

    The file signature is known and does not match a known file extension.

  4. D

    The file signature is unknown and the file extension is known.

Show answer and explanation

Correct answer: D

Question 2 Single choice

RAM is tested during which phase of the power-up sequence?

  1. A

    Pre-POST

  2. B

    After POST

  3. C

    During POST

  4. D

    None of the above.

Show answer and explanation

Correct answer: C

Question 3 Single choice

Which is the proper formula for determining the size in bytes of a hard drive that uses cylinders (C), heads (H), and sectors (S) geometry?

  1. A

    C X H + S

  2. B

    C X H X S + 512

  3. C

    C X H X S X 512

  4. D

    C X H X S

Show answer and explanation

Correct answer: C

Question 4 Single choice

Select the appropriate name for the highlighted area of the binary numbers.

  1. A

    Byte

  2. B

    Dword

  3. C

    Bit

  4. D

    Word

  5. E

    Nibble

Show answer and explanation

Correct answer: E

Question 5 Single choice

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column.

Where does that date and time come from?

  1. A

    Directory Entry

  2. B

    Master File Table

  3. C

    Info2 file

  4. D

    Inode Table

Show answer and explanation

Correct answer: C

Question 6 Single choice

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
[\x00- \x05]\x00\x00?>[?[@?[?[?[

  1. A

    FF 0000 00 00 FF BA

  2. B

    0000 00 01 FF FF BA

  3. C

    04 06 0000 00 FF FF BA

  4. D

    04 0000 00 FF FF BA

Show answer and explanation

Correct answer: D

Question 7 Single choice

The case file should be archived with the evidence files at the termination of a case.

  1. A

    True

  2. B

    False

Show answer and explanation

Correct answer: A

Question 8 Single choice

4 bits allows what number of possibilities?

  1. A

    16

  2. B

    4

  3. C

    2

  4. D

    8

Show answer and explanation

Correct answer: A

Question 9 Single choice

The EnCase default export folder is:

  1. A

    A case-specific setting that cannot be changed.

  2. B

    A case-specific setting that can be changed.

  3. C

    A global setting that can be changed.

  4. D

    A global setting that cannot be changed.

Show answer and explanation

Correct answer: B

Question 10 Single choice

Before utilizing an analysis technique on computer evidence, the investigator should:

  1. A

    Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.

  2. B

    Be trained in the employment of the technique.

  3. C

    Botha and b.

  4. D

    Neithera or b.

Show answer and explanation

Correct answer: C