A30-327 Online Practice Questions and Answers

You used FTK Imager to create several hash list files. You view the location where the files were exported. What is the file extension type for these files?

A. .txt = ASCII Text File

B. .dif = Data Interchange Format

C. .prn = Formatted Text Delimited

D. .csv = Comma Separated Values

In FTK, which tab provides specific information on the evidence items, file items, file status and file category?

A. E-mail tab

B. Explore tab

C. Overview tab

D. Graphics tab

You want to search for two words within five words of each other.

Which search request would accomplish this function?

A. apple by pear w/5

B. June near July w/5

C. supernova w/5cassiopeia

D. supernova bycassiopeia w/5

You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

A. Explore tab

B. Graphics tab

C. Overview tab

D. Bookmark tab

Using the FTK Report Wizard, which two options are available in the Bookmarks - A window? (Choose two.)

A. Apply a filter to the list

B. Group all filenames at end of report

C. Yes, include all graphics in the case

D. No, do not include a bookmark section

E. Export full-size graphics and link them to the thumbnails

You view a registry file in Registry Viewer. You want to create a report, which includes items that you have marked "Add to Report." Which Registry Viewer option accomplishes this task?

A. Common Areas

B. Generate Report

C. Define Summary Report

D. Manage Summary Reports

Which Registry Viewer function would allow you to automatically document multiple unknown user names?

A. Add to Report

B. Export User List

C. Add to Report with Children

D. Summary Report with Wildcard

Click the Exhibit button.

When decrypting EFS files in a case, you receive the result shown in the exhibit.

What is the most plausible explanation for this result?

A. The encrypted file was corrupt.

B. A different user encrypted the remaining encrypted file.

C. The hash value of the remaining encrypted file did not match.

D. The remaining encrypted file had previously been bookmarked.

E. An incorrect CRC value for the $EFS certificate was applied by the user.

Which two Registry Viewer operations can be conducted from FTK? (Choose two.)

A. list SAM file account names in FTK

B. view all registry files from within FTK

C. createsubitems of individual keys for FTK

D. export a registry report to the FTK case report

Into which two categories can an imported hash set be assigned? (Choose two.)

A. alert

B. ignore

C. contraband

D. system files