Magnet MCFE Exam Questions
and Answers
What's the header for a Windows Registry file? - Answer-REGF
User Assist is in what file? - Answer-NTUSER.DAT
LNK files may point to files that no longer exist in active data. - Answer-True
LNK files can be used to show that a file once existed even if it couldn't be found itself. -
Answer-True
LNK files point to a _________________ file. - Answer-Target
Recent Docs > Custom Destinations = _____________ _______________. - Answer-
User Pinned
Axiom uses ________________ modules for decryption. - Answer-Passware
CCleaner deletes _________ files and ___________ cache - Answer-Temp Web
A Recovery Key is less useful than a password. - Answer-False
How does Axiom identify encrypted files? - Answer-Plug-ins leased from Passware
Does "Encrypted File Artifacts" display what program was used to encrypt the file? -
Answer-No
What does Axiom Process search for when identifying encryption/anti-forensic tools
artifacts? - Answer-Known executables
The "Refined Artifacts" view can serve as leads in an investigation/analysis. - Answer-
True
"OQ" = ___________ _______________ - Answer-Original Query (User)
"OQ" means something was actually typed - Answer-True
"Parsed Searches" means all other search engines EXCEPT Google. - Answer-True
, Facebook users can NOT change Facebook ID. - Answer-False. They can.
You may have to use online tools to convert Facebook IDs to User ID before serving
legal process. - Answer-True
Workstations should have fast drives and high input/output operations. - Answer-True
Remove duplicates removes them from the same or multiple sources? - Answer-Same
Search speed increases as multi-tasking increases. - Answer-False
Does Axiom automatically hash files larger than 500 MB? - Answer-It does NOT
All images and videos are AUTOMATICALLY hashed. - Answer-True
You should always keep case files and evidence files separate. - Answer-True
Evidence sources available can be dependent on the Axiom license type. - Answer-True
Full = __________________ image - Answer-Physical
"All Files & Folders" = __________________________ - Answer-Logical File System
"All Files & Folders" captures deleted data. - Answer-False
"Targeted" = ____________ image and _________________ image - Answer-Logical &
Triage
"Targeted" acquires areas most likely to contain evidence. - Answer-True
"Quick" search searches MOST COMMON areas - Answer-True
"Full" search searches ALL areas. - Answer-True
"Sector-Level" search does NOT read raw data - Answer-False
"Sector-Level" can't be used for chip-off - Answer-False
"Sector-Level" can be used for carving - Answer-True
Evidence Sources - File browser shows hidden files and folders. - Answer-False
Evidence Sources is using Windows Explorer and not Axiom. - Answer-True
Keywords are ____________ created by processing - Answer-Artifacts
and Answers
What's the header for a Windows Registry file? - Answer-REGF
User Assist is in what file? - Answer-NTUSER.DAT
LNK files may point to files that no longer exist in active data. - Answer-True
LNK files can be used to show that a file once existed even if it couldn't be found itself. -
Answer-True
LNK files point to a _________________ file. - Answer-Target
Recent Docs > Custom Destinations = _____________ _______________. - Answer-
User Pinned
Axiom uses ________________ modules for decryption. - Answer-Passware
CCleaner deletes _________ files and ___________ cache - Answer-Temp Web
A Recovery Key is less useful than a password. - Answer-False
How does Axiom identify encrypted files? - Answer-Plug-ins leased from Passware
Does "Encrypted File Artifacts" display what program was used to encrypt the file? -
Answer-No
What does Axiom Process search for when identifying encryption/anti-forensic tools
artifacts? - Answer-Known executables
The "Refined Artifacts" view can serve as leads in an investigation/analysis. - Answer-
True
"OQ" = ___________ _______________ - Answer-Original Query (User)
"OQ" means something was actually typed - Answer-True
"Parsed Searches" means all other search engines EXCEPT Google. - Answer-True
, Facebook users can NOT change Facebook ID. - Answer-False. They can.
You may have to use online tools to convert Facebook IDs to User ID before serving
legal process. - Answer-True
Workstations should have fast drives and high input/output operations. - Answer-True
Remove duplicates removes them from the same or multiple sources? - Answer-Same
Search speed increases as multi-tasking increases. - Answer-False
Does Axiom automatically hash files larger than 500 MB? - Answer-It does NOT
All images and videos are AUTOMATICALLY hashed. - Answer-True
You should always keep case files and evidence files separate. - Answer-True
Evidence sources available can be dependent on the Axiom license type. - Answer-True
Full = __________________ image - Answer-Physical
"All Files & Folders" = __________________________ - Answer-Logical File System
"All Files & Folders" captures deleted data. - Answer-False
"Targeted" = ____________ image and _________________ image - Answer-Logical &
Triage
"Targeted" acquires areas most likely to contain evidence. - Answer-True
"Quick" search searches MOST COMMON areas - Answer-True
"Full" search searches ALL areas. - Answer-True
"Sector-Level" search does NOT read raw data - Answer-False
"Sector-Level" can't be used for chip-off - Answer-False
"Sector-Level" can be used for carving - Answer-True
Evidence Sources - File browser shows hidden files and folders. - Answer-False
Evidence Sources is using Windows Explorer and not Axiom. - Answer-True
Keywords are ____________ created by processing - Answer-Artifacts
