GD0-110 Exam Dumps

<< Prev Question Next Question >>

Question 42/170

A CPU is:

A. A motherboard with all required devices connected.

B. An entire computer box, not including the monitor and other attached peripheral devices.

C. A chip that would be considered the brain of a computer, which is installed on a motherboard.

D. A Central Programming Unit.

Question List (170q): Question 1: Which of the following aspects of the EnCase evidence file c...; Question 2: If an evidence file has been added to a case and completely ...; Question 3: A file extension and signature can be manually added by:...; Question 4: When a non-compressed evidence file is reacquired with compr...; Question 5: Which of the following is commonly used to encode e-mail att...; Question 6: Bookmarks are stored in which of the following files?...; Question 7: A hard drive has 8 sectors per cluster. File Mystuff.doc has...; Question 8: The following GREP expression was typed in exactly as shown....; Question 9: For an EnCase evidence file acquired with a hash value to pa...; Question 10: An Enhanced Metafile would best be described as:...; Question 11: The case number in an evidence file can be changed without c...; Question 12: Hash libraries are commonly used to:...; Question 13: Within EnCase, clicking on save on the toolbar affects what ...; Question 14: The following GREP expression was typed in exactly as shown....; Question 15: Select the appropriate name for the highlighted area of the ...; Question 16: If cluster number 10 in the FAT contains the number 55, this...; Question 17: When undeleting a file in the FAT file system, EnCase will c...; Question 18: To undelete a file in the FAT file system, EnCase obtains th...; Question 19: You are examining a hard drive that has Windows XP installed...; Question 20: The temporary folder of a case cannot be changed once it has...; Question 21: By default, EnCase will display the data from the end of a l...; Question 22: The Unicode system can address ____ characters?...; Question 23: If a hash analysis is run on a case, EnCase:...; Question 24: Which statement would most accurately describe a motherboard...; Question 25: RAM is used by the computer to:...; Question 26: In Windows, the file MyNote.txt is deleted from C Drive and ...; Question 27: EnCase uses the _________________ to conduct a signature ana...; Question 28: Calls to the C:\ volume of the hard drive are not made by DO...; Question 29: What information in a FAT file system directory entry refers...; Question 30: You are at an incident scene and determine that a computer c...; Question 31: If cluster #3552 entry in the FAT table contains a value of ...; Question 32: The default export folder remains the same for all cases....; Question 33: How does EnCase verify that the case information (Case Numbe...; Question 34: The Windows 98 Start Menu has a selection called documents w...; Question 35: The EnCase methodology dictates that ________ be created pri...; Question 36: The FAT in the File Allocation Table file system keeps track...; Question 37: The results of a hash analysis on an evidence file that has ...; Question 38: What files are reconfigured or deleted by EnCase during the ...; Question 39: A physical file size is:; Question 40: Using good forensic practices, when seizing a computer at a ...; Question 41: A sector on a hard drive contains how many bytes?...; Question 42: A CPU is:; Question 43: What are the EnCase configuration .ini files used for?...; Question 44: When Unicode is selected for a search keyword, EnCase:...; Question 45: By default, what color does EnCase use for slack?...; Question 46: You are conducting an investigation and have encountered a c...; Question 47: Which is the proper formula for determining the size in byte...; Question 48: The end of a logical file to the end of the cluster that the...; Question 49: When an EnCase user double-clicks on a file within EnCase wh...; Question 50: In Unicode, one printed character is composed of ____ bytes ...; Question 51: In Windows 2000 and XP, which of the following directories c...; Question 52: The following keyword was typed in exactly as shown. Choose ...; Question 53: When a file is deleted in the FAT file system, what happens ...; Question 54: The EnCase evidence file is best described as:...; Question 55: A hash set would most accurately be described as:...; Question 56: An EnCase evidence file of a hard drive ________ be restored...; Question 57: The EnCase case file can be best described as:...; Question 58: The term signature and reader as they relate to a signature ...; Question 59: A hash library would most accurately be described as:...; Question 60: ROM is an acronym for:; Question 61: What information should be obtained from the BIOS during com...; Question 62: When a drive letter is assigned to a logical volume, that in...; Question 63: If a hard drive is left in a room while acquiring, and sever...; Question 64: How many copies of the FAT are located on a FAT 32, Windows ...; Question 65: The following keyword was typed in exactly as shown. Choose ...; Question 66: RAM is an acronym for:; Question 67: During the power-up sequence, which of the following happens...; Question 68: The EnCase default export folder is:...; Question 69: A suspect typed a file on his computer and saved it to a flo...; Question 70: To undelete a file in the FAT file system, EnCase computes t...; Question 71: When an EnCase user double-clicks on a valid .jpg file, that...; Question 72: Within EnCase, you highlight a range of data within a file. ...; Question 73: A signature analysis has been run on a case. The result "*JP...; Question 74: Which of the following would be a true statement about the f...; Question 75: Within EnCase for Windows, the search process is:...; Question 76: The acronym ASCII stands for:; Question 77: How does EnCase verify that the evidence file contains an ex...; Question 78: EnCase can make an image of a USB flash drive....; Question 79: Two allocated files can occupy one cluster, as long as they ...; Question 80: A sector on a floppy disk is the same size as a sector on a ...; Question 81: The first sector on a hard drive is called the:...; Question 82: When does the POST operation occur?...; Question 83: A SCSI host adapter would most likely perform which of the f...; Question 84: What does the acronym BIOS stand for?...; Question 85: A logical file would be best described as:...; Question 86: Assume that MyNote.txt has been deleted. The FAT file system...; Question 87: A personal data assistant was placed in a evidence locker un...; Question 88: The case file should be archived with the evidence files at ...; Question 89: By default, what color does EnCase use for the contents of a...; Question 90: In the FAT file system, the size of a deleted file can be fo...; Question 91: Select the appropriate name for the highlighted area of the ...; Question 92: When a file is deleted in the FAT file system, what happens ...; Question 93: The first sector on a volume is called the:...; Question 94: If a floppy diskette is in the a drive, the computer will al...; Question 95: The following keyword was typed in exactly as shown. Choose ...; Question 96: This question addresses the EnCase for Windows search proces...; Question 97: All investigators using EnCase should run tests on the evide...; Question 98: Temp files created by EnCase are deleted when EnCase is prop...; Question 99: When a file is deleted in the FAT or NTFS file systems, what...; Question 100: The following keyword was typed in exactly as shown. Choose ...; Question 101: Which of the following items could contain digital evidence?...; Question 102: Consider the following path in a FAT file system: C:\My Docu...; Question 103: A SCSI drive is pinned as a master when it is:...; Question 104: The MD5 hash algorithm produces a _____ number....; Question 105: Before utilizing an analysis technique on computer evidence,...; Question 106: When handling computer evidence, an investigator should:...; Question 107: You are working in a computer forensic lab. A law enforcemen...; Question 108: The signature table data is found in which of the following ...; Question 109: The spool files that are created during a print job are ____...; Question 110: Assume that an evidence file is added to a case, the case is...; Question 111: You are an investigator and have encountered a computer that...; Question 112: A standard Windows 98 boot disk is acceptable for booting a ...; Question 113: Which of the following statements is more accurate?...; Question 114: An evidence file can be moved to another directory without c...; Question 115: When a document is printed using EMF in Windows, what file(s...; Question 116: The EnCase evidence file logical filename can be changed wit...; Question 117: Searches and bookmarks are stored in the evidence file....; Question 118: Creating an image of a hard drive that was seized as evidenc...; Question 119: This question addresses the EnCase for Windows search proces...; Question 120: A hard drive has been formatted as NTFS and Windows XP was i...; Question 121: Which of the following selections is NOT found in the case f...; Question 122: To later verify the contents of an evidence file? 7RODWHUYHU...; Question 123: In DOS and Windows, how many bytes are in one FAT directory ...; Question 124: How many clusters can a FAT 16 system address?...; Question 125: 4 bits allows what number of possibilities?...; Question 126: When can an evidence file containing a NTFS partition be log...; Question 127: How many partitions can be found in the boot partition table...; Question 128: To generate an MD5 hash value for a file, EnCase:...; Question 129: RAM is tested during which phase of the power-up sequence?...; Question 130: Which of the following selections would be used to keep trac...; Question 131: If cases are worked on a lab drive in a secure room, without...; Question 132: Which of the following would most likely be an add-in card?...; Question 133: EnCase marks a file as overwritten when _____________ has be...; Question 134: A hard drive was imaged using EnCase. The original drive was...; Question 135: You are investigating a case of child pornography on a hard ...; Question 136: Within EnCase, what is purpose of the default export folder?...; Question 137: Which of the following directories contain the information t...; Question 138: You are assigned to assist with the search and seizure of se...; Question 139: EnCase can build a hash set of a selected group of files....; Question 140: Search terms are case sensitive by default....; Question 141: How are the results of a signature analysis examined?...; Question 142: Which of the following is found in the FileSignatures.ini co...; Question 143: You are investigating a case involving fraud. You seized a c...; Question 144: Within EnCase, what is the purpose of the temp folder?...; Question 145: Will EnCase allow a user to write data into an acquired evid...; Question 146: The EnCase methodology dictates that the lab drive for evide...; Question 147: In DOS acquisition mode, if a physical drive is detected, bu...; Question 148: Changing the filename of a file will change the hash value o...; Question 149: A FAT directory has as a logical size of:...; Question 150: The BIOS chip on an IBM clone computer is most commonly loca...; Question 151: The boot partition table found at the beginning of a hard dr...; Question 152: In hexadecimal notation, one byte is represented by _____ ch...; Question 153: EnCase is able to read and examine which of the following fi...; Question 154: A restored floppy diskette will have the same hash value as ...; Question 155: Select the appropriate name for the highlighted area of the ...; Question 156: Search results are found in which of the following files?...; Question 157: The following GREP expression was typed in exactly as shown....; Question 158: Pressing the power button on a computer that is running coul...; Question 159: A case file can contain ____ hard drive images?...; Question 160: The EnCase signature analysis is used to perform which of th...; Question 161: In the EnCase environment, the term external viewers is best...; Question 162: Assume that MyNote.txt was allocated to clusters 5, 9, and 1...; Question 163: The following GREP expression was typed in exactly as shown....; Question 164: GREP terms are automatically recognized as GREP by EnCase....; Question 165: The maximum file segment size for an EnCase evidence file is...; Question 166: Select the appropriate name for the highlighted area of the ...; Question 167: Search terms are stored in what .ini configuration file?...; Question 168: Select the appropriate name for the highlighted area of the ...; Question 169: An evidence file was archived onto five CD-Rom disks with th...; Question 170: A signature analysis has been run on a case. The result "Bad...

Question 42/170

LEAVE A REPLY

Download PDF File