A30-327 AccessData Exam Questions and Free Practice Test

Question 7

To obtain protected files on a live machine with FTK Imager, which evidence item should be added?

A. image file

B. currently booted drive

C. server object settings

D. profile access control list

Correct Answer:B

Question 8

Into which two categories can an imported hash set be assigned? (Choose two.)

A. alert

B. ignore

C. contraband

D. system files

Correct Answer:AB

Question 9

Which pattern does the following regular expression recover?
(d{4}[- ]){3}d{4}

A. 000-000-0000

B. ddd-4-3-dddd-4-3

C. 000-00000-000-ABC

D. 0000-0000-0000-0000

Correct Answer:D

Question 10

You successfully export and create a file hash list while using FTK Imager. Which three pieces of information are included in this file? (Choose three.)

A. MD5

B. SHA1

C. filename

D. record date

E. date modified

Correct Answer:ABC

Question 11

In FTK, which two formats can be used to export an E-mail message? (Choose two.)

A. raw format

B. XML format

C. PDF format

D. HTML format

E. binary format

Correct Answer:AD

Question 12

You examine evidence and flag several graphic images found in different folders. You now want to bookmark these items into a single bookmark. Which tab in FTK do you use to view only the flagged thumbnails?

A. Explore tab

B. Graphics tab

C. Overview tab

D. Bookmark tab

Correct Answer:C

START A30-327 EXAM