312-49v10 Free Practice Test

- (Exam Topic 1)
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation?

1. A. Image the disk and try to recover deleted files
2. B. Seek the help of co-workers who are eye-witnesses
3. C. Check the Windows registry for connection data (you may or may not recover)
4. D. Approach the websites for evidence

Correct Answer: A

- (Exam Topic 1)
The offset in a hexadecimal code is:

1. A. The last byte after the colon
2. B. The 0x at the beginning of the code
3. C. The 0x at the end of the code
4. D. The first byte after the colon

Correct Answer: B

- (Exam Topic 3)
Investigators can use the Type Allocation Code (TAC) to find the model and origin of a mobile device. Where is TAC located in mobile devices?

1. A. International Mobile Equipment Identifier (IMEI)
2. B. Integrated circuit card identifier (ICCID)
3. C. International mobile subscriber identity (IMSI)
4. D. Equipment Identity Register (EIR)

Correct Answer: A

- (Exam Topic 3)
NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

1. A. Encrypted FEK
2. B. Checksum
3. C. EFS Certificate Hash
4. D. Container Name

Correct Answer: B

- (Exam Topic 2)
Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?

1. A. Portable Document Format
2. B. Advanced Forensics Format (AFF)
3. C. Proprietary Format
4. D. Raw Format

Correct Answer: B