GD0-100 Online Practice Questions and Answers

The EnCase default export folder is:

A. A case-specific setting that cannot be changed.

B. A case-specific setting that can be changed.

C. A global setting that can be changed.

D. A global setting that cannot be changed.

EnCase uses the _________________ to conduct a signature analysis.

A. Both a and b

B. file signature table

C. hash library

D. file Viewers

Pressing the power button on a computer that is running could have which of the following results?

A. The computer will instantly shut off.

B. The computer will go into stand-by mode.

C. Nothing will happen.

D. All of the above could happen.

E. The operating system will shut down normally.

What files are reconfigured or deleted by EnCase during the creation of an EnCase boot disk?

A. command.com

B. autoexec.bat

C. drvspace.bin

D. io.sys

Which of the following items could contain digital evidence?

A. Credit card readers

B. Personal assistant devices

C. Cellular phones

D. Digital cameras

The maximum file segment size for an EnCase evidence file is:

A. 1500 MB

B. 1000 MB

C. 2000 MB

D. There is no limit.

E. 500 MB

A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?

A. Chain-of-custody

B. Storage

C. There is no concern

D. Cross-contamination

During the power-up sequence, which of the following happens first?

A. The boot sector is located on the hard drive.

B. Theower On Self-Test.? 7KH ? RZHU2Q6HOI7HVW

C. The floppy drive is checked for a diskette.

D. The BIOS on an add-in card is executed.

A SCSI host adapter would most likely perform which of the following tasks?

A. Configure the motherboard settings to the BIOS.

B. None of the above.

C. Set up the connection of IDE hard drives.

D. Make SCSI hard drives and other SCSI devices accessible to the operating system.

How many partitions can be found in the boot partition table found at the beginning of the drive?

A. 8

B. 4

C. 6

D. 2

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Speed and Meth

A. Meth

B. Meth Speed

C. Speed andMeth

D. Speed

Within EnCase, what is the purpose of the temp folder?

A. This is the folder used to hold copies of files that are sent to external viewers.

B. This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

C. This is the folder that temporarily stores all bookmark and search results.

D. This is the folder that will be automatically selected when the copy/unerase feature is used. This is the folder that will be automatically selected when the copy/unerase feature is used.

The term signature and reader as they relate to a signature analysis are

A. None of the above

B. The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.

C. Synonymous.

D. Areas compared with each other to verify the correct file type.

When Unicode is selected for a search keyword, EnCase:

A. None of the above.

B. Will find the keyword if it is either Unicode or ASCII.

C. Unicode is not a search option for EnCase.

D. Will only find the keyword if it is Unicode.

EnCase can build a hash set of a selected group of files.

A. True

B. False