Guidance Software GD0-110 Online Practice Questions and Exam Preparation

Guidance Software GD0-110 Online Questions & Answers

• Question 1:

  Creating an image of a hard drive that was seized as evidence:

  A. Should be done by the user, as they are most familiar with the hard drive.
  B. May only be done by trained personnel because the process has the potential to alter the original evidence.
  C. May be done by anyone because it is a relatively simple procedure.
  D. May only be done by computer scientists.
  B. May only be done by trained personnel because the process has the potential to alter the original evidence.

• Question 2:

  An Enhanced Metafile would best be described as:

  A. A compound e-mail attachment.
  B. A graphics file attached to an e-mail message.
  C. A file format used in the printing process by Windows.
  D. A compressed zip file.
  C. A file format used in the printing process by Windows.

• Question 3:

  If a floppy diskette is in the drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the drive, the computer will always boot to that drive before any other device.

  A. True
  B. False
  B. False

• Question 4:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [^a-z]Tom[^a-z]

  A. Tom
  B. Toms
  C. Tomato
  D. Stomp
  A. Tom

• Question 5:

  Changing the filename of a file will change the hash value of the file.

  A. True
  B. False
  A. True

• Question 6:

  Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

  A. True
  B. False
  A. True

• Question 7:

  The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. 800[) \-]+555-1212

  A. 800-555 1212
  B. 800.555.1212
  C. 8005551212
  D. (800) 555-1212
  D. (800) 555-1212

• Question 8:

  Which of the following would most likely be an add-in card?

  A. Anything plugged into socket 7
  B. A motherboard
  C. A video card that is connected to the motherboard in the AGP slot
  D. The board that connects to the power supply
  C. A video card that is connected to the motherboard in the AGP slot

• Question 9:

  RAM is an acronym for:

  A. Random Addressable Memory
  B. Relative Addressable Memory
  C. Relative Address Memory
  D. Random Access Memory
  D. Random Access Memory

• Question 10:

  Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file?

  A. The investigator name The investigator? name
  B. The acquisition notes
  C. None of the above
  D. The evidence number
  C. None of the above