312-49v10 Free Practice Test

- (Exam Topic 1)
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

1. A. one who has NTFS 4 or 5 partitions
2. B. one who uses dynamic swap file capability
3. C. one who uses hard disk writes on IRQ 13 and 21
4. D. one who has lots of allocation units per block or cluster

Correct Answer: D

- (Exam Topic 3)
Which of the following stand true for BIOS Parameter Block?

1. A. The BIOS Partition Block describes the physical layout of a data storage volume
2. B. The BIOS Partition Block is the first sector of a data storage device
3. C. The length of BIOS Partition Block remains the same across all the file systems
4. D. The BIOS Partition Block always refers to the 512-byte boot sector

Correct Answer: A

- (Exam Topic 3)
What do you call the process in which an attacker uses magnetic field over the digital media device to delete any previously stored data?

1. A. Disk deletion
2. B. Disk cleaning
3. C. Disk degaussing
4. D. Disk magnetization

Correct Answer: C

- (Exam Topic 3)
Pick the statement which does not belong to the Rule 804. Hearsay Exceptions; Declarant Unavailable.

1. A. Statement of personal or family history
2. B. Prior statement by witness
3. C. Statement against interest
4. D. Statement under belief of impending death

Correct Answer: D

- (Exam Topic 2)
Jacob is a computer forensics investigator with over 10 years experience in investigations and has written over 50 articles on computer forensics. He has been called upon as a qualified witness to testify the accuracy and integrity of the technical log files gathered in an investigation into computer fraud. What is the term used for Jacob testimony in this case?

1. A. Justification
2. B. Authentication
3. C. Reiteration
4. D. Certification

Correct Answer: B