- (Exam Topic 3)
What is the investigator trying to view by issuing the command displayed in the following screenshot?

1. A. List of services stopped
2. B. List of services closed recently
3. C. List of services recently started
4. D. List of services installed

Correct Answer: D

- (Exam Topic 2)
The following is a log file screenshot from a default installation of IIS 6.0.

What time standard is used by IIS as seen in the screenshot?

1. A. UTC
2. B. GMT
3. C. TAI
4. D. UT

Correct Answer: A

- (Exam Topic 1)
Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the MAC, or unique identifier, of the machine that created the document. What is that code called?

1. A. the Microsoft Virtual Machine Identifier
2. B. the Personal Application Protocol
3. C. the Globally Unique ID
4. D. the Individual ASCII String

Correct Answer: C

- (Exam Topic 2)
In Windows Security Event Log, what does an event id of 530 imply?

1. A. Logon Failure – Unknown user name or bad password
2. B. Logon Failure – User not allowed to logon at this computer
3. C. Logon Failure – Account logon time restriction violation
4. D. Logon Failure – Account currently disabled

Correct Answer: C

- (Exam Topic 1)
During the course of a corporate investigation, you find that an Employee is committing a crime. Can the Employer file a criminal complaint with Police?

1. A. Yes, and all evidence can be turned over to the police
2. B. Yes, but only if you turn the evidence over to a federal law enforcement agency
3. C. No, because the investigation was conducted without following standard police procedures
4. D. No, because the investigation was conducted without warrant

Correct Answer: A