Certification Exam for EnCE Outside North America (GD0-110) Free Practice Test

Question 1

An EnCase evidence file of a hard drive ________ be restored to another hard drive of equal or greater size.

A. cannot

B. can

Correct Answer: B

Question 2

The BIOS chip on an IBM clone computer is most commonly located on:

A. The microprocessor

B. The controller card

C. The motherboard

D. The RAM chip

Correct Answer: C

Question 3

Before utilizing an analysis technique on computer evidence, the investigator should:

A. Test the technique on simulated evidence in a controlled environment to confirm that the results are consistent.

B. Both a and b.

C. Be trained in the employment of the technique.

D. Neither a or b.

Correct Answer: B

Question 4

CORRECT TEXT
A standard Windows 98 boot disk is acceptable for booting a suspect drive.

A. False

B. True

Correct Answer: B

Question 5

The Windows 98 Start Menu has a selection called ocuments?which displays a list of recently used files. Which of the following The Windows 98 Start Menu has a selection called ?ocuments?which displays a list of recently used files. Which of the following folders contain those files?

A. C:\Windows\Documents

B. C:\Windows\Start menu\Documents

C. C:\Windows\Recent

D. C:\Windows\History

Correct Answer: C

Question 6

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

A. No. Archived files are compressed and cannot be verified until un-archived.

B. Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

C. No. All file segments must be put back together.

D. No. EnCase cannot verify files on CDs.

Correct Answer: B

Question 7

Using good forensic practices, when seizing a computer at a business running Windows 2000 Server you should:

A. Pull the plug from the wall.

B. Press the power button and hold it in.

C. Shut it down normally.

D. Pull the plug from the back of the computer.

Correct Answer: C

Question 8

The EnCase case file can be best described as:

A. A file that contains information specific to one case.

B. None of the above.

C. The file that runs EnCase for Windows.

D. A file contain configuration settings for cases.

Correct Answer: A

Question 9

The acronym ASCII stands for:

A. American Standard Code for Information Interchange

B. Accepted Standard Communication Information Index

C. Accepted Standard Code for Information Interchange

D. American Standard Communication Information Index

Correct Answer: A

Question 10

EnCase marks a file as overwritten when _____________ has been allocated to another file.

A. the starting cluster of the file

B. the directory entry for the file

C. all of the file

D. any part of the file

Correct Answer: A

Question 11

This question addresses the EnCase for Windows search process. If a target word is located in the unallocated space, and the word is fragmented between clusters 10 and 15, the search:

A. Will not find it unless ile slack?is checked on the search dialog box. Will not find it unless ?ile slack?is checked on the search dialog box.

B. Will find it because EnCase performs a logical search.

C. Will not find it because EnCase performs a physical search only.

D. Will not find it because the letters of the keyword are not contiguous.

Correct Answer: D

Welcome to TestSimulate

Guidance Software Certification Exam for EnCE Outside North America (GD0-110) Free Practice Test