- (Exam Topic 3)
What malware analysis operation can the investigator perform using the jv16 tool?

1. A. Files and Folder Monitor
2. B. Installation Monitor
3. C. Network Traffic Monitoring/Analysis
4. D. Registry Analysis/Monitoring

Correct Answer: D

- (Exam Topic 3)
After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

1. A. PRIV.STM
2. B. PUB.EDB
3. C. PRIV.EDB
4. D. PUB.STM

Correct Answer: D

- (Exam Topic 2)
When marking evidence that has been collected with the “aaa/ddmmyy/nnnn/zz” format, what does the “nnnn” denote?

1. A. The initials of the forensics analyst
2. B. The sequence number for the parts of the same exhibit
3. C. The year he evidence was taken
4. D. The sequential number of the exhibits seized by the analyst

Correct Answer: D

- (Exam Topic 4)
Fred, a cybercrime Investigator for the FBI, finished storing a solid-state drive In a static resistant bag and filled out the chain of custody form. Two days later. John grabbed the solid-state drive and created a clone of It (with write blockers enabled) In order to Investigate the drive. He did not document the chain of custody though. When John was finished, he put the solid-state drive back in the static resistant and placed it back in the evidence locker. A day later, the court trial began and upon presenting the evidence and the supporting documents, the chief Justice outright rejected them. Which of the following statements strongly support the reason for rejecting the evidence?

1. A. Block clones cannot be created with solid-state drives
2. B. Write blockers were used while cloning the evidence
3. C. John did not document the chain of custody
4. D. John investigated the clone instead of the original evidence itself

Correct Answer: C

- (Exam Topic 3)
Korey, a data mining specialist in a knowledge processing firm DataHub.com, reported his CISO that he has lost certain sensitive data stored on his laptop. The CISO wants his forensics investigation team to find if the data loss was accident or intentional. In which of the following category this case will fall?

1. A. Civil Investigation
2. B. Administrative Investigation
3. C. Both Civil and Criminal Investigations
4. D. Criminal Investigation

Correct Answer: B