- (Exam Topic 3)
Which of the following email headers specifies an address for mailer-generated errors, like "no such user" bounce messages, to go to (instead of the sender's address)?

1. A. Mime-Version header
2. B. Content-Type header
3. C. Content-Transfer-Encoding header
4. D. Errors-To header

Correct Answer: D

- (Exam Topic 2)
Which of the following files gives information about the client sync sessions in Google Drive on Windows?

1. A. sync_log.log
2. B. Sync_log.log
3. C. sync.log
4. D. Sync.log

Correct Answer: B

- (Exam Topic 2)
Harold is a computer forensics investigator working for a consulting firm out of Atlanta Georgia. Harold is called upon to help with a corporate espionage case in Miami Florida. Harold assists in the investigation by
pulling all the data from the computers allegedly used in the illegal activities. He finds that two suspects in the company where stealing sensitive corporate information and selling it to competing companies. From the email and instant messenger logs recovered, Harold has discovered that the two employees notified the buyers by writing symbols on the back of specific stop signs. This way, the buyers knew when and where to meet with the alleged suspects to buy the stolen material. What type of steganography did these two suspects use?

1. A. Text semagram
2. B. Visual semagram
3. C. Grill cipher
4. D. Visual cipher

Correct Answer: B

- (Exam Topic 3)
Report writing is a crucial stage in the outcome of an investigation. Which information should not be included in the report section?

1. A. Speculation or opinion as to the cause of the incident
2. B. Purpose of the report
3. C. Author of the report
4. D. Incident summary

Correct Answer: A

- (Exam Topic 1)
When using Windows acquisitions tools to acquire digital evidence, it is important to use a well-tested hardware write-blocking device to:

1. A. Automate Collection from image files
2. B. Avoiding copying data from the boot partition
3. C. Acquire data from host-protected area on a disk
4. D. Prevent Contamination to the evidence drive

Correct Answer: D