Certification Exam For ENCE North America (GD0-100) Practice Test

Questions # 31:

The MD5 hash algorithm produces a _____ number.

Options:

32 bit

256 bit

64 bit

128 bit

Questions # 32:

How does EnCase verify that the case information (Case Number, Evidence Number, Investigator Name, etc) in an evidence file has not been damaged or changed, after the evidence file has been written?

Options:

a search of the physical disk in unallocated clusters and other unused disk areas

a search of the logical files

both a and b

None of the above

Questions # 33:

4 bits allows what number of possibilities?

Options:

Questions # 34:

Within EnCase, you highlight a range of data within a file. The length indicator displays the value 30. How many bytes have you actually selected?

Options:

Questions # 35:

Changing the filename of a file will change the hash value of the file.

Options:

True

False

Questions # 36:

An evidence file can be moved to another directory without changing the file verification.

Options:

False

True

Questions # 37:

The EnCase signature analysis is used to perform which of the following actions?

Options:

Analyzing the relationship of a file signature to its file extension.Analyzing the relationship of a file signature to its file extension.

Analyzing the relationship of a file signature to its file header.Analyzing the relationship of a file signature to its file header.

Analyzing the relationship of a file signature to a list of hash sets.Analyzing the relationship of a file signature to a list of hash sets.

Analyzing the relationship of a file signature to its computed MD5 hash value.Analyzing the relationship of a file signature to its computed MD5 hash value.

Questions # 38:

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

Options:

tom jones

Tom

Jones

Tom Jones

Questions # 39:

If an evidence file has been added to a case and completely verified, what happens if the data area within the evidence file is later changed?

Options:

EnCase will allow the examiner to continue to access the rest of the evidence file that has not been changed.

EnCase detect the error if the evidence file is manually re-verified.

EnCase will detect the error when that area of the evidence file is accessed by the user.

All of the above.

Questions # 40:

When can an evidence file containing a NTFS partition be logically restored to a FAT 32 partition?

Options:

Never

When the FAT 32 has the same number of sectors / clusters.

When the FAT 32 is the same size or bigger.

Both a and b

Viewing page 4 out of 6 pages

Viewing questions 31-40 out of questions

Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Guidance Software EnCE GD0-100 Questions and answers with ExamsMirror

Exam GD0-100 Premium Access

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

Options:

TOP CODES