- (Exam Topic 1)
Which is a standard procedure to perform during all computer forensics investigations?

1. A. with the hard drive removed from the suspect PC, check the date and time in the system's CMOS
2. B. with the hard drive in the suspect PC, check the date and time in the File Allocation Table
3. C. with the hard drive removed from the suspect PC, check the date and time in the system's RAM
4. D. with the hard drive in the suspect PC, check the date and time in the system's CMOS

Correct Answer: A

- (Exam Topic 3)
Data Files contain Multiple Data Pages, which are further divided into Page Header, Data Rows, and Offset Table. Which of the following is true for Data Rows?

1. A. Data Rows store the actual data
2. B. Data Rows present Page typ
3. C. Page ID, and so on
4. D. Data Rows point to the location of actual data
5. E. Data Rows spreads data across multiple databases

Correct Answer: B

- (Exam Topic 2)
What stage of the incident handling process involves reporting events?

1. A. Containment
2. B. Follow-up
3. C. Identification
4. D. Recovery

Correct Answer: C

- (Exam Topic 3)
Which of the following is a precomputed table containing word lists like dictionary files and brute force lists and their hash values?

1. A. Directory Table
2. B. Rainbow Table
3. C. Master file Table (MFT)
4. D. Partition Table

Correct Answer: B

- (Exam Topic 2)
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?

1. A. Record the system state by taking photographs of physical system and the display
2. B. Perform data acquisition without disturbing the state of the systems
3. C. Open the systems, remove the hard disk and secure it
4. D. Switch off the systems and carry them to the laboratory

Correct Answer: A