Free GD0-100 Exam Dumps Preview

Question 1

Single choice

RAM is used by the computer to:

1. A

   Execute the POST during start-up.

2. B

   Temporarily store electronic data that is being processed.

3. C

   Permanently store electronic data.

4. D

   Establish a connection with external devices.

Reveal answer details Close answer details

Correct answerB

Question 2

Single choice

During the power-up sequence, which of the following happens first?

1. A

   The boot sector is located on the hard drive.

2. B

   Theower On Self-Test.? 7KH ? RZHU2Q6HOI7HVW

3. C

   The floppy drive is checked for a diskette.

4. D

   The BIOS on an add-in card is executed.

Reveal answer details Close answer details

Correct answerB

Question 3

Single choice

EnCase can build a hash set of a selected group of files.

1. A

   True

2. B

   False

Reveal answer details Close answer details

Correct answerA

Question 4

Single choice

The EnCase default export folder is:

1. A

   A case-specific setting that cannot be changed.

2. B

   A case-specific setting that can be changed.

3. C

   A global setting that can be changed.

4. D

   A global setting that cannot be changed.

Reveal answer details Close answer details

Correct answerB

Question 5

Single choice

If a hash analysis is run on a case, EnCase:

1. A

   Will compute a hash value of the evidence file and begin a verification process.

2. B

   Will generate a hash set for every file in the case.

3. C

   Will compare the hash value of the files in the case to the hash library.

4. D

   Will create a hash set to the user specifications. Will create a hash set to the user?specifications.

Reveal answer details Close answer details

Correct answerC

Question 6

Single choice

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

1. A

   True

2. B

   False

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

In the FAT file system, the size of a deleted file can be found:

1. A

   In the FAT

2. B

   In the directory entry

3. C

   In the file footer

4. D

   In the file header

Reveal answer details Close answer details

Correct answerB

Question 8

Single choice

A personal data assistant was placed in a evidence locker until an examiner has time to examine it.

Which of the following areas would require special attention?

1. A

   Chain-of-custody

2. B

   Storage

3. C

   There is no concern

4. D

   Cross-contamination

Reveal answer details Close answer details

Correct answerB

Question 9

Single choice

EnCase uses the _________________ to conduct a signature analysis.

1. A

   Both a and b

2. B

   file signature table

3. C

   hash library

4. D

   file Viewers

Reveal answer details Close answer details

Correct answerB

Question 10

Single choice

When a file is deleted in the FAT file system, what happens to the FAT?

1. A

   The FAT entries for that file are marked as allocated.

2. B

   Nothing.

3. C

   It is deleted as well.

4. D

   The FAT entries for that file are marked as available.

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Within EnCase, what is purpose of the default export folder?

1. A

   This is the folder that will be automatically selected when the copy/unerase feature is used.

2. B

   This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

3. C

   This is the folder that temporarily stores all bookmark and search results.

4. D

   This is the folder used to hold copies of files that are sent to external viewers.

Reveal answer details Close answer details

Correct answerA

Question 12

Single choice

The EnCase methodology dictates that ________ be created prior to acquiring evidence.

1. A

   a unique directory on the lab drive for case management

2. B

   a text file for notes

3. C

   All of the above

4. D

   an .E01 file on the lab drive

Reveal answer details Close answer details

Correct answerA

Question 13

Single choice

The EnCase case file can be best described as:

1. A

   The file that runs EnCase for Windows.

2. B

   A filecontain configuration settings for cases.

3. C

   None of the above.

4. D

   A file that contains information specific to one case.

Reveal answer details Close answer details

Correct answerD

Question 14

Single choice

The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result.
Jan 1 st , 2?0?00

1. A

   Jan 1st , 1900

2. B

   Jan 1st , 2100

3. C

   Jan 1st , 2001

4. D

   Jan 1st , 2000

Reveal answer details Close answer details

Correct answerD

Question 15

Single choice

A hash set would most accurately be described as:

1. A

   A group of hash libraries organized by category.

2. B

   A group of hash values that can be added to the hash library.

3. C

   A table of file headers and extensions.

4. D

   Botha and b.

Reveal answer details Close answer details

Correct answerB

Question 16

Single choice

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

1. A

   EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

2. B

   EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

3. C

   The .case file writes a CRC value for the case information and verifies it when the case is opened.

4. D

   EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

Reveal answer details Close answer details

Correct answerA

Question 17

Single choice

Select the appropriate name for the highlighted area of the binary numbers.

1. A

   Word

2. B

   Byte

3. C

   Bit

4. D

   Nibble

5. E

   Dword

Reveal answer details Close answer details

Correct answerB

Question 18

Single choice

Creating an image of a hard drive that was seized as evidence:

1. A

   May be done by anyone because it is a relatively simple procedure.

2. B

   May only be done by trained personnel because the process has the potential to alter the original evidence.

3. C

   May only be done by computer scientists.

4. D

   Should be done by the user, as they are most familiar with the hard drive.

Reveal answer details Close answer details

Correct answerB

Question 19

Single choice

The first sector on a volume is called the:

1. A

   Master file table

2. B

   Volume boot device

3. C

   Volume boot sector or record

4. D

   Master boot record

Reveal answer details Close answer details

Correct answerC

Question 20

Single choice

Searches and bookmarks are stored in the evidence file.

1. A

   False

2. B

   True

Reveal answer details Close answer details

Correct answerA

Question 21

Single choice

How many copies of the FAT are located on a FAT 32, Windows 98-formatted partition?

1. A

   2

2. B

   3

3. C

   1

4. D

   4

Reveal answer details Close answer details

Correct answerA

Question 22

Single choice

You are examining a hard drive that has Windows XP installed as the operating system. You see a file that has a date and time in the deleted column.

Where does that date and time come from?

1. A

   Directory Entry

2. B

   Master File Table

3. C

   Info2 file

4. D

   Inode Table

Reveal answer details Close answer details

Correct answerC

Question 23

Single choice

Select the appropriate name for the highlighted area of the binary numbers.

1. A

   Bit

2. B

   Nibble

3. C

   Word

4. D

   Dword

5. E

   Byte

Reveal answer details Close answer details

Correct answerC

Question 24

Single choice

If a floppy diskette is in the ?drive, the computer will always boot to that drive before any other device. If a floppy diskette is in the drive, the computer will always boot to that drive before any other device.

1. A

   False

2. B

   True

Reveal answer details Close answer details

Correct answerA

Question 25

Single choice

What does the acronym BIOS stand for?

1. A

   Basic Integrated Operating System

2. B

   Basic Input/Output System

3. C

   Binary Input/Output System

4. D

   Binary Integrated Operating System

Reveal answer details Close answer details

Correct answerB

Question 26

Single choice

When handling computer evidence, an investigator should:

1. A

   Both a and b

2. B

   Make any changes to the evidence that will further the investigation.

3. C

   Neither a or b

4. D

   Avoid making any changes to the original evidence.

Reveal answer details Close answer details

Correct answerD

Question 27

Single choice

When a document is printed using EMF in Windows, what file(s) are generated in the spooling process?

1. A

   The .SHD file

2. B

   The .SPL file

3. C

   Neither a or b

4. D

   Both a and b

Reveal answer details Close answer details

Correct answerD

Question 28

Single choice

This question addresses the EnCase for Windows search process. If a target word is within a logical file, and it begins in cluster 10 and ends in cluster 15 (the word is fragmented), the search:

1. A

   Will not find it unlessile slack is checked on the search dialog box.

2. B

   Will find it because EnCase performs a logical search.

3. C

   Will not find it because EnCase performs a physical search only.

4. D

   Will not find it because the letters of the keyword are not contiguous.

Reveal answer details Close answer details

Correct answerB