312-49v10 Free Practice Test

- (Exam Topic 3)
Which of the following is a responsibility of the first responder?

1. A. Determine the severity of the incident
2. B. Collect as much information about the incident as possible
3. C. Share the collected information to determine the root cause
4. D. Document the findings

Correct Answer: B

- (Exam Topic 3)
Raw data acquisition format creates ______ of a data set or suspect drive.

1. A. Segmented image files
2. B. Simple sequential flat files
3. C. Compressed image files
4. D. Segmented files

Correct Answer: B

- (Exam Topic 1)
To make sure the evidence you recover and analyze with computer forensics software can be admitted in court, you must test and validate the software. What group is actively providing tools and creating procedures for testing and validating computer forensics software?

1. A. Computer Forensics Tools and Validation Committee (CFTVC)
2. B. Association of Computer Forensics Software Manufactures (ACFSM)
3. C. National Institute of Standards and Technology (NIST)
4. D. Society for Valid Forensics Tools and Testing (SVFTT)

Correct Answer: C

- (Exam Topic 2)
Where does Encase search to recover NTFS files and folders?

1. A. MBR
2. B. MFT
3. C. Slack space
4. D. HAL

Correct Answer: B

- (Exam Topic 2)
John is working as a computer forensics investigator for a consulting firm in Canada. He is called to seize a computer at a local web caf purportedly used as a botnet server. John thoroughly scans the computer and finds nothing that would lead him to think the computer was a botnet server. John decides to scan the virtual memory of the computer to possibly find something he had missed. What information will the virtual memory scan produce?

1. A. It contains the times and dates of when the system was last patched
2. B. It is not necessary to scan the virtual memory of a computer
3. C. It contains the times and dates of all the system files
4. D. Hidden running processes

Correct Answer: D