Guidance Software GD0-100 Online Practice Questions and Exam Preparation

Guidance Software GD0-100 Online Questions & Answers

• Question 101:

  A standard Windows 98 boot disk is acceptable for booting a suspect drive.

  A. True
  B. False
  B. False

• Question 102:

  The EnCase signature analysis is used to perform which of the following actions?

  A. Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.
  B. Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.
  C. Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.
  D. Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.
  A. Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.

• Question 103:

  Which of the following is commonly used to encode e-mail attachments?

  A. GIF
  B. EMF
  C. JPEG
  D. Base64
  D. Base64

• Question 104:

  The boot partition table found at the beginning of a hard drive is located in what sector?

  A. Volume boot sector
  B. Master boot record
  C. Master file table
  D. Volume boot record
  B. Master boot record

• Question 105:

  A SCSI host adapter would most likely perform which of the following tasks?

  A. Configure the motherboard settings to the BIOS.
  B. None of the above.
  C. Set up the connection of IDE hard drives.
  D. Make SCSI hard drives and other SCSI devices accessible to the operating system.
  D. Make SCSI hard drives and other SCSI devices accessible to the operating system.

• Question 106:

  An evidence file can be moved to another directory without changing the file verification.

  A. False
  B. True
  B. True

• Question 107:

  The EnCase evidence file logical filename can be changed without affecting the verification of the acquired evidence.

  A. True
  B. False
  B. False

• Question 108:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. Bob@ [a-z]+.com

  A. Bob@New zealand.com
  B. [email protected]
  C. [email protected]
  D. [email protected]
  C. [email protected]

• Question 109:

  Which of the following is found in the FileSignatures.ini configuration file

  A. The results of a hash analysis
  B. The information contained in the signature table
  C. The results of a signature analysis
  D. Pointers to an evidence file
  B. The information contained in the signature table

• Question 110:

  Hash libraries are commonly used to:

  A. Compare a file header to a file extension.
  B. Identify files that are already known to the user.
  C. Compare one hash set with another hash set.
  D. Verify the evidence file.
  B. Identify files that are already known to the user.