312-49v11 Practice Test

312-49v11 Practice Test practice questions, page 15 of 18, with answer review and explanations.

Question 71

A file requires 10 KB space to be saved on a hard disk partition. An entire cluster of 32 KB has been allocated for this file. The remaining, unused space of 22 KB on this cluster will be identified as ____________.

  1. Swap space
  2. Cluster space
  3. Slack space
  4. Sector space

Question 72

Which layer in the IoT architecture is comprised of hardware parts such as sensors, RFID tags, and devices that play an important role in data collection?

  1. Access gateway layer
  2. Application layer
  3. Edge technology layer
  4. Middleware layer

Question 73

Which of the following tools will allow a forensic investigator to acquire the memory dump of a suspect machine so that it may be investigated on a forensic workstation to collect evidentiary data like processes and Tor browser artifacts?

  1. DB Browser SQLite
  2. Belkasoft Live RAM Capturer and AccessData FTK Imager
  3. Bulk Extractor
  4. Hex Editor

Question 74

"No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court" - this principle is advocated by which of the following?

  1. FBI Cyber Division
  2. Scientific Working Group on Imaging Technology (SWGIT)
  3. The Association of Chief Police Officers (ACPO) Principles of Digital Evidence
  4. Locard's exchange principle

Question 75

Cloud forensic investigations impose challenges related to multi-jurisdiction and multi-tenancy aspects. To have a better understanding of the roles and responsibilities between the cloud service provider (CSP) and the client, which document should the forensic investigator review?

  1. National and local regulation
  2. Service level agreement
  3. Key performance indicator
  4. Service level management