Вы находитесь на странице: 1из 9
Pass4itSure IT Certification Braindumps https://www.pass4itsure.com/1z0-068.html [2017-NEW] 1Z0-068 Dumps Best Quality For

Pass4itSure IT Certification Braindumps

[2017-NEW]

1Z0-068 Dumps

1Z0-068 Dumps

Best Quality For Free Download

RELEASED

QUESTIONNO:1

AFATdirectoryhasasalogicalsizeof:

A.Onecluster

B.0bytes

C.128bytes

D.64bytes

Answer:B

QUESTIONNO:2

InDOSandWindows,howmanybytesareinoneFATdirectoryentry?

A.16

B.8

C.32

D.Variable

E.64

Answer:C

QUESTIONNO:3

EnCaseisabletoreadandexaminewhichofthefollowingfilesystems? A.HFS B.FATC. NTFSD.

EXT3

Answer:A,B,C,D

QUESTIONNO:4

ThefollowingGREPexpressionwastypedinexactlyasshown.Choosetheanswer(s)that would

result.[\x00-\x05]\x00\x00\x00?>?[?[@?[?[?[

A.00000001FFFFBA

B.FF00000000FFBA

C.04000000FFFFBA

D.0406000000FFFFBA

Answer:C

QUESTIONNO:5

Bydefault,whatcolordoesEnCaseuseforthecontentsofalogicalfile?

A.Red

B.Redonblack

C.Black

D.Blackonred

Answer:C

QUESTIONNO:6

4bitsallowswhatnumberofpossibilities?

A.16

B.2

C.4

D.8

Answer:A

QUESTIONNO:7

AharddrivehasbeenformattedasNTFSandWindowsXPwasinstalled.Theuserused

fdiskto

removeallpartitionsfromthatdrive.Nothingelsewasdone.Youhaveimagedthedriveand

have

openedtheevidencefilewithEnCase.Whatwouldbethebestwaytoexaminethishard

drive?

A.EnCasewillnotseeadrivethathasbeenfdisked.

B.UsetheecoveredDeletedPartitions?featureandthenexaminethesystem.Use

the?ecovered

DeletedPartitions?featureandthenexaminethesystem.

C.Conductaphysicalsearchoftheharddriveandbookmarkanyevidence.

D.UsetheddPartition?featuretorebuildthepartitionandthenexaminethesystem.Use

the?dd

Partition?featuretorebuildthepartitionandthenexaminethesystem.

Answer:D

QUESTIONNO:8

ForanEnCaseevidencefileacquiredwithahashvaluetopassverification,whichofthe following mustbetrue?

A.EithertheCRCorMD5hashvaluesmustverify.

B.TheCRCvaluesmustverify.

C.TheCRCvaluesandtheMD5hashvaluebothmustverify.

D.TheMD5hashvaluemustverify.

Answer:C

QUESTIONNO:9

WhichofthefollowingselectionswouldbeusedtokeeptrackofafragmentedfileintheFAT

file

system?

A.Alloftheabove

B.Thepartitiontableofextents

C.TheFileAllocationTable

D.Thedirectoryentryforthefragmentedfile

Answer:C

QUESTIONNO:10

WithinEnCaseforWindows,thesearchprocessis:

A.asearchofthelogicalfiles

B.asearchofthephysicaldiskinunallocatedclustersandotherunuseddiskareas

C.bothaandb

D.Noneoftheabove

Answer:C

QUESTIONNO:11

InWindows,thefileMyNote.txtisdeletedfromCDriveandisautomaticallysenttothe ecycle Bin.?ThelongfilenamewasInWindows,thefileMyNote.txtisdeletedfromCDriveandis automaticallysenttothe?ecycleBin.?ThelongfilenamewasMyNote.txtandtheshort filename wasMYNOTE.TXT.WhenviewingtheecycleBin?withEnCase,howwillthelongfilename and MyNote.txtandtheshortfilenamewasMYNOTE.TXT.Whenviewingthe?ecycleBin?with EnCase,howwillthelongfilenameandshortfilenameappear?

A.MyNote.txt,DC0.txt

B.MyNote.del,DC1.del

C.MyNote.txt,CD0.txt

D.MyNote.del,DC0.del

Answer:A

QUESTIONNO:12

Inhexadecimalnotation,onebyteisrepresentedbycharacter(s).

A.8

B.4

C.2

D.1

Answer:C

QUESTIONNO:13

Hashlibrariesarecommonlyusedto:

A.Compareafileheadertoafileextension.

B.Compareonehashsetwithanotherhashset.

C.Identifyfilesthatarealreadyknowntotheuser.

D.Verifytheevidencefile.

Answer:C

QUESTIONNO:14

Apersonaldataassistantwasplacedinaevidencelockeruntilanexaminerhastimeto

examine

it.Whichofthefollowingareaswouldrequirespecialattention?

A.Chain-of-custody

B.Cross-contamination

C.Storage

D.Thereisnoconcern

Answer:C

QUESTIONNO:15

HowmanycopiesoftheFATarelocatedonaFAT32,Windows98-formattedpartition?

A.3

B.1

C.4

D.2

Answer:D

QUESTIONNO:16

Ifcasesareworkedonalabdriveinasecureroom,withoutanycleaningofthecontentsof

the

drive,whichofthefollowingareaswouldbeofmostconcern?

A.Storage

B.Thereisnoconcern

C.Chain-of-custody

D.Cross-contamination

Answer:D

QUESTIONNO:17

Whichofthefollowingwouldmostlikelybeanadd-incard?

A.Anythingpluggedintosocket7

B.Amotherboard

C.AvideocardthatisconnectedtothemotherboardintheAGPslot

D.Theboardthatconnectstothepowersupply

Answer:C

QUESTIONNO:18

WhichofthefollowingwouldbeatruestatementaboutthefunctionoftheBIOS?

A.TheBIOSisresponsibleforcheckingandconfiguringthesystemafterthepoweris

turnedon.B.Bothaandc.

C.TheBIOSisresponsibleforswappingoutmemorypageswhenRAMfillsup.

D.TheBIOSintegratescompressedexecutablefileswithmemoryaddressesforfaster

execution.

Answer:A

QUESTIONNO:19

WhenanEnCaseuserdouble-clicksonavalid.jpgfile,thatfileis:

A.RenamedtoJPG_0001.jpgandcopiedtothedefaultexportfolder.

B.Copiedtothedefaultexportfolderandopenedbyanassociatedprogram.

C.OpenedbyEnCase.

D.CopiedtotheEnCasespecifiedtempfolderandopenedbyanassociatedprogram.

Answer:D

QUESTIONNO:20

RAMisanacronymfor:

A.RandomAddressableMemory

B.RelativeAddressableMemory

C.RelativeAddressMemory

D.RandomAccessMemory

Answer:D

QUESTIONNO:21

Theresultsofahashanalysisonanevidencefilethathasbeenaddedtoacasewillbe

storedin

whichofthefollowingfiles?

A.Theevidencefile

B.Thecasefile

C.TheconfigurationHashAnalysis.inifile

D.Alloftheabove

Answer:B

QUESTIONNO:22

TheEnCasedefaultexportfolderis:

A.Aglobalsettingthatcannotbechanged.

B.Acase-specificsettingthatcanbechanged.

C.Aglobalsettingthatcanbechanged.

D.Acase-specificsettingthatcannotbechanged.

Answer:B

QUESTIONNO:23

WhataretheEnCaseconfiguration.inifilesusedfor?

A.StoringinformationthatwillbeavailabletoEnCaseeachtimeitisopened,regardlessof

the

activecase(s).

B.Storingtheresultsofasignatureanalysis.

C.Storingpointerstoacquiredevidence.

D.Storinginformationthatisspecifictoaparticularcase.

Answer:A

QUESTIONNO:24

ACPUis:

A.Achipthatwouldbeconsideredthebrainofacomputer,whichisinstalledona

motherboard.

B.ACentralProgrammingUnit.

C.Anentirecomputerbox,notincludingthemonitorandotherattachedperipheraldevices.

D.Amotherboardwithallrequireddevicesconnected.

Answer:A

QUESTIONNO:25

Acasefilecancontainharddriveimages?

A.1

B.5

C.10

D.anynumberof

Answer:D

QUESTIONNO:26CORRECTTEXT

AstandardDOS6.22bootdiskisacceptableforbootingasuspectdrive.

Answer:True

Answer:False

Answer:Pending

QUESTIONNO:27CORRECTTEXT

Thetemporaryfolderofacasecannotbechangedonceithasbeenset.

Answer:True

Answer:False

Answer:Pending

QUESTIONNO:28

InUnicode,oneprintedcharacteriscomposedof

A.1

B.8

C.4

D.2

Answer:D

QUESTIONNO:29

Thesignaturetabledataisfoundinwhichofthefollowingfiles?

A.Thecasefile

B.Alloftheabove

C.TheconfigurationFileSignatures.inifile

D.Theevidencefile

Answer:C

QUESTIONNO:30

WhatdoestheacronymBIOSstandfor?

A.BasicIntegratedOperatingSystem

B.BasicInput/OutputSystem

C.BinaryInput/OutputSystem

D.BinaryIntegratedOperatingSystem

Answer:B

QUESTIONNO:31

IntheEnCaseenvironment,thetermxternalviewers?isbestdescribedas:IntheEnCase

environment,theterm?xternalviewers?isbestdescribedas:

A.Programsthatareexportedoutofanevidencefile.

B.ProgramsthatareassociatedwithEnCasetoopenspecificfiletypes.

C.AnyprogramthatwillworkwithEnCase.

D.Anyprogramthatisloadedonthelabharddrive.

Answer:B

QUESTIONNO:32CORRECTTEXT

Arestoredfloppydiskettewillhavethesamehashvalueastheoriginaldiskette.

Answer:True

Answer:False

Answer:Pending

QUESTIONNO:33

ThisquestionaddressestheEnCaseforWindowssearchprocess.Ifatargetwordiswithin

a

logicalfile,anditbeginsincluster10andendsincluster15(thewordisfragmented),the

search:

A.WillfinditbecauseEnCaseperformsalogicalsearch.

B. Will not find it unless ile slack?is checked on the search dialog box. Will not find it

unless?ile

slack?ischeckedonthesearchdialogbox.

C.WillnotfinditbecauseEnCaseperformsaphysicalsearchonly.

D.Willnotfinditbecausethelettersofthekeywordarenotcontiguous.

Answer:A

QUESTIONNO:34

By default, EnCasewill display the data from the end of a logical file, to the end of the cluster,in whatcolor:

A.Red

B.Black

C.Redonblack

D.Blackonred

Answer:A

QUESTIONNO:35

WhatinformationinaFATfilesystemdirectoryentryreferstothelocationofafileonthe

hard

drive?

A.Thestartingcluster

B.Thefragmentationsettings

C.Thefileattributes

D.Thefilesize

Answer:A

QUESTIONNO:36

Selecttheappropriatenameforthehighlightedareaofthebinarynumbers.

A.Nibble

B.Byte

C.Dword

D.Bit

E.Word

Answer:E