We're so confident of our products that we provide no hassle product exchange.
Guidance Software Certification Exam for EnCE Outside North America Sample Questions:
1. RAM is an acronym for:
A) Relative Addressable Memory
B) Relative Address Memory
C) Random Addressable Memory
D) Random Access Memory
2. To later verify the contents of an evidence file? 7RODWHUYHULI\WKHFRQWHQWVRIDQHYLGHQFHILOH
A) EnCase writes a CRC value for every 128 sectors copied.
B) EnCase writes an MD5 hash value every 64 sectors copied.
C) EnCase writes a CRC value for every 64 sectors copied.
D) EnCase writes an MD5 hash value for every 32 sectors copied.
3. Which of the following is found in the FileSignatures.ini configuration file?
A) Pointers to an evidence file
B) The results of a hash analysis
C) The results of a signature analysis
D) The information contained in the signature table
4. The EnCase signature analysis is used to perform which of the following actions?
A) Analyzing the relationship of a file signature to a list of hash sets. Analyzing the relationship of a file? signature to a list of hash sets.
B) Analyzing the relationship of a file signature to its computed MD5 hash value. Analyzing the relationship of a file? signature to its computed MD5 hash value.
C) Analyzing the relationship of a file signature to its file header. Analyzing the relationship of a file? signature to its file header.
D) Analyzing the relationship of a file signature to its file extension. Analyzing the relationship of a file? signature to its file extension.
5. A personal data assistant was placed in a evidence locker until an examiner has time to examine it. Which of the following areas would require special attention?
A) Cross-contamination
B) Storage
C) Chain-of-custody
D) There is no concern
Solutions:
| Question # 1 Answer: D | Question # 2 Answer: C | Question # 3 Answer: D | Question # 4 Answer: D | Question # 5 Answer: B |
By Eudora
