312-49v10 Free Practice Test

- (Exam Topic 3)
What is the name of the first reserved sector in File allocation table?

1. A. Volume Boot Record
2. B. Partition Boot Sector
3. C. Master Boot Record
4. D. BIOS Parameter Block

Correct Answer: C

- (Exam Topic 1)
Item 2If you come across a sheepdip machine at your client site, what would you infer?

1. A. A sheepdip coordinates several honeypots
2. B. A sheepdip computer is another name for a honeypot
3. C. A sheepdip computer is used only for virus-checking.
4. D. A sheepdip computer defers a denial of service attack

Correct Answer: C

- (Exam Topic 3)
Where should the investigator look for the Edge browser’s browsing records, including history, cache, and cookies?

1. A. ESE Database
2. B. Virtual Memory
3. C. Sparse files
4. D. Slack Space

Correct Answer: A

- (Exam Topic 1)
Melanie was newly assigned to an investigation and asked to make a copy of all the evidence from the compromised system. Melanie did a DOS copy of all the files on the system. What would be the primary reason for you to recommend a disk imaging tool?

1. A. A disk imaging tool would check for CRC32s for internal self-checking and validation and have MD5 checksum
2. B. Evidence file format will contain case data entered by the examiner and encrypted at the beginning of the evidence file
3. C. A simple DOS copy will not include deleted files, file slack and other information
4. D. There is no case for an imaging tool as it will use a closed, proprietary format that if compared to the original will not match up sector for sector

Correct Answer: C

- (Exam Topic 1)
An Employee is suspected of stealing proprietary information belonging to your company that he had no rights to possess. The information was stored on the Employees Computer that was protected with the NTFS Encrypted File System (EFS) and you had observed him copy the files to a floppy disk just before leaving work for the weekend. You detain the Employee before he leaves the building and recover the floppy disks and secure his computer. Will you be able to break the encryption so that you can verify that that the employee was in possession of the proprietary information?

1. A. EFS uses a 128-bit key that can't be cracked, so you will not be able to recover the information
2. B. When the encrypted file was copied to the floppy disk, it was automatically unencrypted, so you can recover the information.
3. C. The EFS Revoked Key Agent can be used on the Computer to recover the information
4. D. When the Encrypted file was copied to the floppy disk, the EFS private key was also copied to the floppy disk, so you can recover the information.

Correct Answer: B