312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 14 of 18, with answer review and explanations.

Question 66

Before accessing digital evidence from victims, witnesses, or suspects, on their electronic devices, what should the investigator do first to respect legal privacy requirements?

  1. Protect the device against external communication
  2. Remove the battery or turn-off the device
  3. Notify the fact to the local authority or employer
  4. Obtain a formal written consent to search

Question 67

During a forensic investigation, a large number of files were collected. The investigator needs to evaluate ownership and accountability of those files. Therefore, he begins to identify attributes such as "author name," "organization name," "network name," or any additional supporting data that is meant for the owner's identification purpose. Which term describes these attributes?

  1. Metadata
  2. Metabase
  3. Data index
  4. Data header

Question 68

Derrick, a forensic specialist, was investigating an active computer that was executing various processes. Derrick wanted to check whether this system was used in an incident that occurred earlier. He started inspecting and gathering the contents of RAM, cache, and DLLs to identify incident signatures. Identify the data acquisition method employed by Derrick in the above scenario.

  1. Dead data acquisition
  2. Non-volatile data acquisition
  3. Static data acquisition
  4. Live data acquisition

Question 69

When analyzing logs, it is important that the clocks of all the network devices are synchronized. Which protocol will help in synchronizing these clocks?

  1. UTC
  2. PTP
  3. UCT
  4. NTP

Question 70

What happens to the header of the file once it is deleted from the Windows OS file systems?

  1. The OS replaces the entire hex byte coding of the file
  2. The hex byte coding of the file remains the same, but the file location differs
  3. The OS replaces the second letter of a deleted file name with a hex byte code: Eh5
  4. The OS replaces the first letter of a deleted file name with a hex byte code: E5h