- (Exam Topic 1)
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

1. A. Sector
2. B. Metadata
3. C. MFT
4. D. Slack Space

Correct Answer: D

- (Exam Topic 3)
Which of the following is a part of a Solid-State Drive (SSD)?

1. A. Head
2. B. Cylinder
3. C. NAND-based flash memory
4. D. Spindle

Correct Answer: C

- (Exam Topic 1)
During the course of an investigation, you locate evidence that may prove the innocence of the suspect of the investigation. You must maintain an unbiased opinion and be objective in your entire fact finding process. Therefore, you report this evidence. This type of evidence is known as:

1. A. Inculpatory evidence
2. B. Mandatory evidence
3. C. Exculpatory evidence
4. D. Terrible evidence

Correct Answer: C

- (Exam Topic 2)
Which among the following files provides email header information in the Microsoft Exchange server?

1. A. gwcheck.db
2. B. PRIV.EDB
3. C. PUB.EDB
4. D. PRIV.STM

Correct Answer: B

- (Exam Topic 1)
Which part of the Windows Registry contains the user's password file?

1. A. HKEY_LOCAL_MACHINE
2. B. HKEY_CURRENT_CONFIGURATION
3. C. HKEY_USER
4. D. HKEY_CURRENT_USER

Correct Answer: A