A30-327 : FTK AccessData Certified Examiner - ACE - Uma ajudinha nas perguntas da certificação em FTK - Parte 4
Quarta parte da coleção de questões para a certificação A30-327 AccessData Certified Examiner ACE, para a ferramenta FTK, FTK Imager, PRTK e Registry Viewer.
Volto a referir que é muito importante a leitura dos manuais:
Manual FTK: http://marketing.accessdata.com/acton/attachment/4390/f-0643/1/-/-/-/-/FTK_UG.pdf
Manual FTK Imager: http://marketing.accessdata.com/acton/attachment/4390/f-000d/1/-/-/-/-/file.pdf
Manual PRTK: http://marketing.accessdata.com/acton/attachment/4390/f-0653/1/-/-/-/-/PRTK_DNA%20User%20Guide.pdf
Manual Registry Viewer: http://marketing.accessdata.com/acton/attachment/4390/f-0672/1/-/-/-/-/RegistryViewer_UG.pdf
Q. Which FTK processing option would indicate a simillarity between two graphic files?
a.Entropy Test
b.PhotoDNA
c.Explicit Image Detection (EID)
d.Meta Carve
Q. Which FTK Tab would allow viewing the Process List from a RAM memory dump file?
a.Graphics Tab
b.Volatile Tab
c.Explore Tab
d.Memory Tab
Q. Which statement is true concerning the Video Thumbnail feature of FTK?
a.Videos can be shortened to make viewing faster
b.Thumbnails can be generated at user-designated intervals
c.Thumbnails are only generated at 10 seconds intervals
d.Videos can be converted to QuickTime (MOV) format
Q. Which statement is true concerning bookmarks in an FTK report?
a.FTK will only allow bookmarks containing graphics to be included in a report
b.An email attachment not part of the original bookmarked email can still be included
c.Bookmarks to be included in a report must be chosen before Report function is started
d.Filters cannot be applied to bookmarks in a report
Q. In which FTK Overview Tab container/node are Internet Explorer index.dat files classified?
a.Archive container
b.Documents container
c.Java Code container
d.Internet/Chat Files container
Q. Which of the following is NOT an option available in the FTK Report?
a.Registry Selections
b.Volatile Data
c.Create a PDF version of the report
d.Videos
Q. The last 3 pages of a 12 page English document contain Portuguese. Which statement below is true?
a.The document will be identified as Portugues by Language Identification in FTK
b.The document will be identified as English by Language Identification in FTK
c.The document's language will not be identified by Language Identification in FTK
d.The document will be identified as "multi-language" by Language Identification in FTK
Q. Which Registry Viewer operation can be conducted from FTK?
a.view all registry files from within FTK
b.create subitems of individual keys for FTK
c.display all encrypted registry content
d.decrypt passwords from the SAM file
Q. In which file format can a list of hash values be imported into FTK?
a.ISO
b.CSV
c.DD
d.AD1
Q. Which statement is true concerning decryption of filesfrom within FTK?
a.EFS files can't be decrypted from within FTK; they must be exported from the case
b.The newly decrypted file replaces the encrypted file in the FTK database
c.Multiple passwords may be attempted simultaneously via Tools > Decrypt Files
d.Only one password at a time may be attempted via Tools > Decrypt Files
Parte 1: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified.HTML
Parte 2: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_11.HTML
Parte 3: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_12.HTML
Parte 5: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_14.HTML
Parte 6: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_28.HTML
Parte 6: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_28.HTML
Parte 7: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_6649.HTML
Parte 8: http://e-forense.blogspot.com/2014/03/q.HTML
Parte 9: http://e-forense.blogspot.com/2014/03/a30-327-ftk-accessdata-certified_31.HTML
Parte 10: http://e-forense.blogspot.com/2014/04/a30-327-ftk-accessdata-certified.HTML
Parte 11: http://e-forense.blogspot.com/2014/04/a30-327-ftk-accessdata-certified_3.html
