GD0-100 by Guidance Software Valid Free Exam Practice Test

Question 1

RAM is used by the computer to

A. Execute the POST during start-up. B. Establish a connection with external devices. C. Permanently store electronic data. D. Temporarily store electronic data that is being processed.

Correct Answer: D

Question 2

The following GREP expression was typed in exactly as shown. Choose the Answer:(s) that would result.[\x00-\x05]\x00\x00?>[?[@?[?[?[

A. 04 0000 00 FF FF BA B. 04 06 0000 00 FF FF BA C. 0000 00 01 FF FF BA D. FF 0000 00 00 FF BA

Correct Answer: A

Question 3

The acronym ASCII stands for

A. American Standard Communication Information Index B. American Standard Code for Information Interchange C. Accepted Standard Communication Information Index D. Accepted Standard Code for Information Interchange

Correct Answer: B

Question 4

Correct Answer:

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename \downloads\check01.jpg that EnCase shows as being moved. The starting extent is 0C4057. You find another filename \downloads\chk1.dll?with the starting extent 0C4057, which EnCase also shows as being moved. In the \windows\System *** Incomplete *** *

Question 5

Which of the following aspects of the EnCase evidence file can be changed during a reacquire of the evidence file

A. The evidence number B. The acquisition notes C. None of the above D. The investigator name

Correct Answer: C

Question 6

The following GREP expression was typed in exactly as shown. Choose the Answer:(s) that would result. 800[) \-]+555-1212

A. 8005551212 B. 800.555.1212 C. (800) 555-1212 D. 800-555 1212

Correct Answer: C

Question 7

EnCase uses the _________________ to conduct a signature analysis.

A. Both a and b B. file Viewers C. file signature table D. hash library

Correct Answer: C

Question 8

Assume that an evidence file is added to a case, the case is saved, and the case is closed. What happens if the evidence file is moved, and the case is then opened?

A. EnCase reports that the file integrity has been compromised and renders the file useless. EnCase reports that the file integrity has been compromised and renders the file useless. B. EnCase asks for the location of the evidence file the next time the case is opened. C. EnCase reports a different hash value for the evidence file. D. EnCase opens the case, excluding the moved evidence.

Correct Answer: B

Question 9

Which of the following would most likely be an add-in card?

A. Anything plugged into socket 7 B. A video card that is connected to the motherboard in the AGP slot C. The board that connects to the power supply D. A motherboard

Correct Answer: B

Question 10

When does the POST operation occur?

A. After a computer begins to boot from a device. B. When SCSI devices are configured. C. When Windows starts up. D. When the power button to a computer is turnedon.

Correct Answer: D

Question 11

A FAT directory has as a logical size of

A. One cluster B. 64 bytes C. 0 bytes D. 128 bytes

Correct Answer: C

Question 12

Search results are found in which of the following files? Select all that apply.

A. The evidence file B. The configuration Searches.ini file C. The case file

Correct Answer: C

Question 13

What information in a FAT file system directory entry refers to the location of a file on the hard drive?

A. The file size B. The file attributes C. The fragmentation settings D. The starting cluster

Correct Answer: D

Guidance Software Certification Exam For ENCE North America - GD0-100 Exam Practice Test