- (Exam Topic 2)
Which program is the bootloader when Windows XP starts up?

1. A. KERNEL.EXE
2. B. NTLDR
3. C. LOADER
4. D. LILO

Correct Answer: B

- (Exam Topic 1)
Corporate investigations are typically easier than public investigations because:

1. A. the users have standard corporate equipment and software
2. B. the investigator does not have to get a warrant
3. C. the investigator has to get a warrant
4. D. the users can load whatever they want on their machines

Correct Answer: B

- (Exam Topic 4)
Consider a scenario where the perpetrator of a dark web crime has unlnstalled Tor browser from their computer after committing the crime. The computer has been seized by law enforcement so they can Investigate It for artifacts of Tor browser usage. Which of the following should the Investigators examine to establish the use of Tor browser on the suspect machine?

1. A. Swap files
2. B. Files in Recycle Bin
3. C. Security logs
4. D. Prefetch files

Correct Answer: A

- (Exam Topic 2)
Amber, a black hat hacker, has embedded a malware into a small enticing advertisement and posted it on a popular ad-network that displays across various websites. What is she doing?

1. A. Click-jacking
2. B. Compromising a legitimate site
3. C. Spearphishing
4. D. Malvertising

Correct Answer: D

- (Exam Topic 3)
UEFI is a specification that defines a software interface between an OS and platform firmware. Where does this interface store information about files present on a disk?

1. A. BIOS-MBR
2. B. GUID Partition Table (GPT)
3. C. Master Boot Record (MBR)
4. D. BIOS Parameter Block

Correct Answer: B