- (Exam Topic 3)
Which of the following is NOT an anti-forensics technique?

1. A. Data Deduplication
2. B. Password Protection
3. C. Encryption
4. D. Steganography

Correct Answer: A

- (Exam Topic 3)
Which among the following tools can help a forensic investigator to access the registry files during postmortem analysis?

1. A. RegistryChangesView
2. B. RegDIIView
3. C. RegRipper
4. D. ProDiscover

Correct Answer: C

- (Exam Topic 3)
Identify the term that refers to individuals who, by virtue of their knowledge and expertise, express an independent opinion on a matter related to a case based on the information that is provided.

1. A. Expert Witness
2. B. Evidence Examiner
3. C. Forensic Examiner
4. D. Defense Witness

Correct Answer: A

- (Exam Topic 2)
Which of the following Event Correlation Approach checks and compares all the fields systematically and
intentionally for positive and negative correlation with each other to determine the correlation across one or multiple fields?

1. A. Rule-Based Approach
2. B. Automated Field Correlation
3. C. Field-Based Approach
4. D. Graph-Based Approach

Correct Answer: B

- (Exam Topic 2)
Annie is searching for certain deleted files on a system running Windows XP OS. Where will she find the files if they were not completely deleted from the system?

1. A. C: $Recycled.Bin
2. B. C: \$Recycle.Bin
3. C. C:\RECYCLER
4. D. C:\$RECYCLER

Correct Answer: B