GD0-110：最新的Guidance Software認證GD0-110考題，Certification Exam for EnCE Outside North America認證

問題1

正確答案:

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename :\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename ?:\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll?with the starting extent 0C4057, which EnCase also shows as being moved. In the :\windows\System? ? ?GRZQORDGV?FKNGOO"ZLWKWKHVWDUWLQJH[WHQW&

問題2
The following keyword was typed in exactly as shown. Choose the answer(s) that would be found. All search criteria have default settings. Tom

A. Tom

B. [email protected]

C. Stomp

D. Tomorrow

正確答案: A,B,C,D

問題3
What are the EnCase configuration .ini files used for?

A. Storing pointers to acquired evidence.

B. Storing the results of a signature analysis.

C. Storing information that is specific to a particular case.

D. Storing information that will be available to EnCase each time it is opened, regardless of the active case(s).

正確答案: D

問題4

正確答案:

You are investigating a case involving fraud. You seized a computer from a suspect who stated that the computer is not used by anyone other than himself. The computer has Windows 98 installed on the hard drive. You find the filename :\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename ?:\downloads\check01.jpg?that EnCase shows as being moved. The starting extent is 0C4057. You find another filename :\downloads\chk1.dll?with the starting extent 0C4057, which EnCase also shows as being moved. In the :\Windows\System? ? ?GRZQORDGV?FKNGOO"ZLWKWKHVWDUWLQJH[WHQW&

問題5
The EnCase default export folder is:

A. A global setting that cannot be changed.

B. A case-specific setting that can be changed.

C. A global setting that can be changed.

D. A case-specific setting that cannot be changed.

正確答案: B

問題6
When handling computer evidence, an investigator should:

A. Neither a or b

B. Avoid making any changes to the original evidence.

C. Make any changes to the evidence that will further the investigation.

D. Both a and b

正確答案: B

問題7
Select the appropriate name for the highlighted area of the binary numbers.

A. Bit

B. Word

C. Byte

D. Nibble

E. Dword

正確答案: A

問題8
If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

A. EnCase detect the error if the evidence file is manually re-verified.

B. EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

C. All of the above.

D. EnCase will detect the error when that area of the evidence file is accessed by the user.

正確答案: C

問題9
4 bits allows what number of possibilities?

A. 2

B. 8

C. 4

D. 16

正確答案: D

問題10
When an EnCase user double-clicks on a valid .jpg file, that file is:

A. Renamed to JPG_0001.jpg and copied to the default export folder.

B. Opened by EnCase.

C. Copied to the EnCase specified temp folder and opened by an associated program.

D. Copied to the default export folder and opened by an associated program.

正確答案: C

最新的Guidance Software Certification Exam for EnCE Outside North America - GD0-110免費考試真題

專業認證

品質保證

輕松通過

免費試用