최신Guidance Software Certification Exam For ENCE North America - GD0-100무료샘플문제
문제1
A signature analysis has been run on a case. The result ?*JPEG ?in the signature column
A signature analysis has been run on a case. The result ?*JPEG ?in the signature column
정답: C
문제2
CORRECT TEXT
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.
CORRECT TEXT
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.
정답: A
문제3
Select the appropriate name for the highlighted area of the binary numbers.
Select the appropriate name for the highlighted area of the binary numbers.
정답: E
문제4
Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?
정답: B
문제5
Within EnCase for Windows, the search process is
Within EnCase for Windows, the search process is
정답: C
문제6
Search terms are stored in what .ini configuration file
Search terms are stored in what .ini configuration file
정답: D
문제7
CORRECT TEXT
Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.
CORRECT TEXT
Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.
정답: A
문제8
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?
정답: D
문제9
For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?
For an EnCase evidence file acquired with a hash value to pass verification, which of the following must be true?
정답: C
문제10
When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?
When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?
정답: C
문제11
The first sector on a volume is called the
The first sector on a volume is called the
정답: C
문제12
In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause
In DOS acquisition mode, if a physical drive is detected, but no partition information is displayed, what would be the cause
정답: D
문제13
Select the appropriate name for the highlighted area of the binary numbers.
Select the appropriate name for the highlighted area of the binary numbers.
정답: C
문제14
정답:
You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename \downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename \downloads\chk1.dll?with the starting extent 0C4057, which EnCase also shows as being moved. In the \Windows\System? *** INCOMPLETE ***