A30-327 Online Practice Questions and Answers

How can you use FTK Imager to obtain registry files from a live system?

A. You use the Export Files option.

B. You use the Advanced Recovery option.

C. Registry files cannot be exported from a live system.

D. You use the Protected Storage System Provider option.

Which three items are contained in an Image Summary File using FTK Imager? (Choose three.)

A. MD5

B. CRC

C. SHA1

D. Sector Count

E. Cluster Count

Click the Exhibit button.

You need to search for specific data that are located in a Microsoft Word document. You do not know the exact spelling of this datA. Using the Index Search Options as displayed in the exhibit, which changes do you make in the Broadening Options and Search Limiting Options containers?

A. check the Fuzzy box;check the File Name Pattern box; type *.doc in the pattern container

B. check the Stemming box; check the File Name Pattern box; type *.doc in the pattern container

C. check the Synonym box;check the File Name Pattern box; type *.doc in the pattern container

D. check the Stemming box; check the File Name Pattern box;type %.doc in the pattern container

Which pattern does the following regular expression recover? (\d{4}[\- ]){3}\d{4}

A. 000-000-0000

B. ddd-4-3-dddd-4-3

C. 000-00000-000-ABC

D. 0000-0000-0000-0000

Click the Exhibit button.

What change do you make to the file filter shown in the exhibit in order to show only graphics with a logical size between 500 kilobytes and 10 megabytes?

A. You change all file status items to a red circle.

B. You change all file status items to a yellow triangle.

C. You make no change. The filter is correct as shown.

D. You change Graphics in the File Type column to a yellow triangle.

Which two options are available in the FTK Report Wizard? (Choose two.)

A. List by File Path

B. List File Properties

C. Include HTML File Listing

D. Include PRTK Output List

Using the FTK Report Wizard, which two options are available in the List by File Path window? (Choose two.)

A. List File Properties

B. Export to the Report

C. Apply a Filter to the List

D. Include Registry Viewer Reports

FTK Imager can be invoked from within which program?

A. FTK

B. DNA

C. PRTK

D. Registry Viewer

What happens when a duplicate hash value is imported into a KFF database?

A. It will not be accepted.

B. It will be marked as a duplicate.

C. The database will be corrupted.

D. The database will hide the duplicate.

You currently store alternate hash libraries on a remote server.

Where do you configure FTK to access these files rather than the default library, ADKFFLibrary.hdb?

A. Preferences

B. User Options

C. Analysis Tools

D. Import KFF Hashes