- (Exam Topic 3)
Which of the following file formats allows the user to compress the acquired data as well as keep it randomly accessible?

1. A. Proprietary Format
2. B. Generic Forensic Zip (gfzip)
3. C. Advanced Forensic Framework 4
4. D. Advanced Forensics Format (AFF)

Correct Answer: B

- (Exam Topic 3)
Which forensic investigation methodology believes that criminals commit crimes solely to benefit their
criminal enterprises?

1. A. Scientific Working Group on Digital Evidence
2. B. Daubert Standard
3. C. Enterprise Theory of Investigation
4. D. Fyre Standard

Correct Answer: C

- (Exam Topic 1)
You are working for a local police department that services a population of 1,000,000 people and you have been given the task of building a computer forensics lab. How many law-enforcement computer investigators should you request to staff the lab?

1. A. 8
2. B. 1
3. C. 4
4. D. 2

Correct Answer: C

- (Exam Topic 4)
Which of the following is the most effective tool for acquiring volatile data from a Windows-based system?

1. A. Coreography
2. B. Datagrab
3. C. Ethereal
4. D. Helix

Correct Answer: D

- (Exam Topic 3)
What is the capacity of Recycle bin in a system running on Windows Vista?

1. A. 2.99GB
2. B. 3.99GB
3. C. Unlimited
4. D. 10% of the partition space

Correct Answer: C