New Year Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

Guidance Software GD0-100 - Certification Exam For ENCE North America

Page: 2 / 6
Total 176 questions

The following keyword was typed in exactly as shown. Choose the answer(s) that would result. All search criteria have default settings. Tom Jones

A.

tom jones

B.

Tom

C.

Jones

D.

Tom Jones

Which of the following would be a true statement about the function of the BIOS?

A.

The BIOS integrates compressed executable files with memory addresses for faster execution.

B.

The BIOS is responsible for checking and configuring the system after the power is turned on.

C.

The BIOS is responsible for swapping out memory pages when RAM fills up.

D.

Both a and c.

Two allocated files can occupy one cluster, as long as they can both fit within the allotted number of bytes.

A.

True

B.

False

An evidence file was archived onto five CD-Rom disks with the third file segment on disk number three. Can the contents of the third file segment be verified by itself while still on the CD?

A.

No. Archived files are compressed and cannot be verified until un-archived.

B.

No. All file segments must be put back together.

C.

Yes. Any segment of an evidence file can be verified through re-computing and comparing the CRCs, even if it is on a CD.

D.

No. EnCase cannot verify files on CDs.

When Unicode is selected for a search keyword, EnCase:

A.

Will find the keyword if it is either Unicode or ASCII.

B.

Unicode is not a search option for EnCase.

C.

Will only find the keyword if it is Unicode.

D.

None of the above.

The spool files that are created during a print job are __________ after the print job is completed.

A.

moved

B.

wiped

C.

deleted and wiped

D.

deleted

EnCase can build a hash set of a selected group of files.

A.

True

B.

False

The boot partition table found at the beginning of a hard drive is located in what sector?

A.

Volume boot sector

B.

Master boot record

C.

Master file table

D.

Volume boot record

The BIOS chip on an IBM clone computer is most commonly located on:

A.

The RAM chip

B.

The controller card

C.

The motherboard

D.

The microprocessor

Calls to the C:\ volume of the hard drive are not made by DOS when a computer is booted with a standard DOS 6.22 boot disk.

A.

False

B.

True