- (Topic 1)
What is the "Best Evidence Rule"?

1. A. It states that the court only allows the original evidence of a document, photograph, or recording at the trial rather than a copy
2. B. It contains system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driverinformation, and command history
3. C. It contains hidden files, slack space, swap file, index.dat files, unallocated clusters, unused partitions, hidden partitions, registry settings, and event logs
4. D. It contains information such as open network connection, user logout, programs that reside in memory, and cache data

Correct Answer: A

- (Topic 3)
On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

1. A. SAM
2. B. AMS
3. C. Shadow file
4. D. Password.conf

Correct Answer: A

- (Topic 2)
When needing to search for a website that is no longer present on the Internet today but was online few years back, what site can be used to view the website collection of pages?view the website? collection of pages?

1. A. Proxify.net
2. B. Dnsstuff.com
3. C. Samspade.org
4. D. Archive.org

Correct Answer: D

- (Topic 3)
What is the target host IP in the following command? C:> firewalk -F 80 10.10.150.1 172.16.28.95 -p UDP

1. A. 10.10.150.1
2. B. This command is using FIN packets, which cannot scan target hosts
3. C. Firewalk does not scan target hosts
4. D. 172.16.28.95

Correct Answer: D

- (Topic 1)
Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible.

1. A. True
2. B. False

Correct Answer: A