최신Guidance Software Certification Exam for EnCE Outside North America - GD0-110무료샘플문제
문제1
When a file is deleted in the FAT file system, what happens to the FAT?
When a file is deleted in the FAT file system, what happens to the FAT?
정답: A
문제2
The first sector on a hard drive is called the:
The first sector on a hard drive is called the:
정답: C
문제3
CORRECT TEXT
Temp files created by EnCase are deleted when EnCase is properly closed.
CORRECT TEXT
Temp files created by EnCase are deleted when EnCase is properly closed.
정답: A
문제4
A file extension and signature can be manually added by:
A file extension and signature can be manually added by:
정답: A
문제5
To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
정답: D
문제6
CORRECT TEXT
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.
CORRECT TEXT
When a non-compressed evidence file is reacquired with compression, the acquisition and verification hash values for the evidence will remain the same for both files.
정답: A
문제7
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
You are at an incident scene and determine that a computer contains evidence as described in the search warrant. When you seize the computer, you should:
정답: A,C,D
문제8
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00? >?[?[@?[?[?[
The following GREP expression was typed in exactly as shown. Choose the answer(s) that would result. [\x00-\x05]\x00\x00\x00? >?[?[@?[?[?[
정답: D
문제9
CORRECT TEXT
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
CORRECT TEXT
A standard Windows 98 boot disk is acceptable for booting a suspect drive.
정답: A
문제10
CORRECT TEXT
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.
CORRECT TEXT
When a drive letter is assigned to a logical volume, that information is temporarily written the volume boot record on the hard drive.
정답: A
문제11
The maximum file segment size for an EnCase evidence file is:
The maximum file segment size for an EnCase evidence file is:
정답: A