- (Exam Topic 3)
Which of the following is a device monitoring tool?

1. A. Capsa
2. B. Driver Detective
3. C. Regshot
4. D. RAM Capturer

Correct Answer: A

- (Exam Topic 2)
A picture file is recovered from a computer under investigation. During the investigation process, the file is enlarged 500% to get a better view of its contents. The picture quality is not degraded at all from this process. What kind of picture is this file. What kind of picture is this file?

1. A. Raster image
2. B. Vector image
3. C. Metafile image
4. D. Catalog image

Correct Answer: B

- (Exam Topic 3)
Steve, a forensic investigator, was asked to investigate an email incident in his organization. The organization has Microsoft Exchange Server deployed for email communications. Which among the following files will Steve check to analyze message headers, message text, and standard attachments?

1. A. PUB.EDB
2. B. PRIV.EDB
3. C. PUB.STM
4. D. PRIV.STM

Correct Answer: B

- (Exam Topic 3)
Which command line tool is used to determine active network connections?

1. A. netsh
2. B. nbstat
3. C. nslookup
4. D. netstat

Correct Answer: D

- (Exam Topic 4)
Web browsers can store relevant information from user activities. Forensic investigators may retrieve files, lists, access history, cookies, among other digital footprints. Which tool can contribute to this task?

1. A. Most Recently Used (MRU) list
2. B. MZCacheView
3. C. Google Chrome Recovery Utility
4. D. Task Manager

Correct Answer: B