Guidance Software Certification Exam For ENCE North America 認定 GD0-100 試験問題:

1. By default, what color does EnCase use for the contents of a logical file

A) Red
B) Red on black
C) Black on red
D) Black

2. The following GREP expression was typed in exactly as shown. Choose the Answer:(s) that would result. [^a-z]Tom[^a-z]

A) Stomp
B) Toms
C) om? ? RP
D) Tomato

3. Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?

A) 5,6,7
B) 6,7,8
C) 7,8,9
D) 5,9,11

4. The EnCase signature analysis is used to perform which of the following actions?

A) Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.
B) Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.
C) Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.
D) Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.

5. The term signature and reader as they relate to a signature analysis are

A) Areas compared with each other to verify the correct file type.
B) None of the above
C) Synonymous.
D) The signature is the file extension. The header is a standard pattern normally found at the beginning of a file.

質問と回答：