312-49v10 Free Practice Test

- (Exam Topic 1)
The offset in a hexadecimal code is:

1. A. The last byte after the colon
2. B. The 0x at the beginning of the code
3. C. The 0x at the end of the code
4. D. The first byte after the colon

Correct Answer: B

- (Exam Topic 3)
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?

1. A. International Mobile Equipment Identifier (IMEI)
2. B. Integrated circuit card identifier (ICCID)
3. C. International mobile subscriber identity (IMSI)
4. D. Equipment Identity Register (EIR)

Correct Answer: A

- (Exam Topic 3)
NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

1. A. Encrypted FEK
2. B. Checksum
3. C. EFS Certificate Hash
4. D. Container Name

Correct Answer: B

- (Exam Topic 2)
Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?

1. A. Portable Document Format
2. B. Advanced Forensics Format (AFF)
3. C. Proprietary Format
4. D. Raw Format

Correct Answer: B

- (Exam Topic 1)
Corporate investigations are typically easier than public investigations because:

1. A. the users have standard corporate equipment and software
2. B. the investigator does not have to get a warrant
3. C. the investigator has to get a warrant
4. D. the users can load whatever they want on their machines

Correct Answer: B