CNIT 420 EXAMS SCRIPT PAPER 2026/2027 QUESTIONS
AND SOLUTIONS RATED A+
✔✔Complementary Metal Oxide Semiconductor - ✔✔Where does the computer store
system configuration and date and time info?
✔✔Erase cycles - ✔✔Why does flash memory have a write endurance limit?
✔✔wear-leveling - ✔✔All flash memory devices have a feature called ______
✔✔garbage collector - ✔✔Where are old memory cells listed in?
✔✔logical addresses - ✔✔Cluster numbers assigned by the OS
✔✔physical addresses - ✔✔Sector numbers
✔✔disk partition - ✔✔Clusters and their addresses are specific to a logical disk drive
✔✔partition - ✔✔A _____ is a logical drive
✔✔partition gap - ✔✔Unused space between partitions
✔✔0x1BE - ✔✔What offset is the first partition at in a hex editor?
✔✔A file is deleted - ✔✔å replaces the first letter of the filename representing what?
✔✔resident and nonresident - ✔✔File or folder info is typically stored in what two ways
in an MFT record?
✔✔Alternate data streams - ✔✔Ways data can be appended to existing files w/o being
seen
✔✔Registry - ✔✔A database that stores hardware and software config information,
network connections, user preferences, and setup info
✔✔.50 - ✔✔Lossless compression can compress up to what percentage of data?
✔✔hash, hashlog, and vf - ✔✔In the Linux dcfldd command, which three options are
used for validating data?
✔✔Amount of data storage needed and type of RAID - ✔✔What are two concerns when
acquiring data from a RAID server?
, ✔✔Antivirus, antispyware, and firewall programs - ✔✔With remote acquisitions, what
problems should you be aware of?
✔✔Fragments of unallocated data in addition to the logical allocated data - ✔✔What
does a sparse acquisition collect for an investigation?
✔✔2 GB - ✔✔What's the maximum file size when writing data to a FAT32 drive?
✔✔T - ✔✔The main goal of a static acquisition is the preservation of digital evidence.
(T/F)
✔✔T - ✔✔With newer Linux kernel distributions, USB devices are automatically
mounted, which can alter data on it. (T/F)
✔✔F - ✔✔FTK Imager can acquire data in a drive's host protected area. (T/F)
✔✔T - ✔✔A hashing algorithm is a program designed to create a binary or hexadecimal
number that represents the uniqueness of a data set, file, or entire disk. (T/F)
✔✔Validation - ✔✔What's the most critical aspect of digital evidence?
✔✔F - ✔✔The plain view doctrine in computer searches is well-established law. (T/F)
✔✔1 - ✔✔As a private-sector investigator, you can become an agent of law
enforcement when which of the following happens?
1. You begin to take orders from a police detective without a warrant or subpoena.
2. Your internal investigation has concluded, and you have filed a criminal complaint
and turned over the evidence to law enforcement.
3. Your internal investigation begins.
4. None of the above.
✔✔T - ✔✔Commingling evidence means that sensitive or confidential information being
mixed with data collected as evidence. (T/F)
✔✔T - ✔✔If a company doesn't distribute a computing use policy stating an employer's
right to inspect employees' computers freely, including e-mail and Web use, employees
have an expectation of privacy. (T/F)
✔✔Ntuser.dat - ✔✔Which of the following Windows 8 files contains user-specific
information?
✔✔Unicode characters and better security - ✔✔List two features NTFS has that FAT
does not.
AND SOLUTIONS RATED A+
✔✔Complementary Metal Oxide Semiconductor - ✔✔Where does the computer store
system configuration and date and time info?
✔✔Erase cycles - ✔✔Why does flash memory have a write endurance limit?
✔✔wear-leveling - ✔✔All flash memory devices have a feature called ______
✔✔garbage collector - ✔✔Where are old memory cells listed in?
✔✔logical addresses - ✔✔Cluster numbers assigned by the OS
✔✔physical addresses - ✔✔Sector numbers
✔✔disk partition - ✔✔Clusters and their addresses are specific to a logical disk drive
✔✔partition - ✔✔A _____ is a logical drive
✔✔partition gap - ✔✔Unused space between partitions
✔✔0x1BE - ✔✔What offset is the first partition at in a hex editor?
✔✔A file is deleted - ✔✔å replaces the first letter of the filename representing what?
✔✔resident and nonresident - ✔✔File or folder info is typically stored in what two ways
in an MFT record?
✔✔Alternate data streams - ✔✔Ways data can be appended to existing files w/o being
seen
✔✔Registry - ✔✔A database that stores hardware and software config information,
network connections, user preferences, and setup info
✔✔.50 - ✔✔Lossless compression can compress up to what percentage of data?
✔✔hash, hashlog, and vf - ✔✔In the Linux dcfldd command, which three options are
used for validating data?
✔✔Amount of data storage needed and type of RAID - ✔✔What are two concerns when
acquiring data from a RAID server?
, ✔✔Antivirus, antispyware, and firewall programs - ✔✔With remote acquisitions, what
problems should you be aware of?
✔✔Fragments of unallocated data in addition to the logical allocated data - ✔✔What
does a sparse acquisition collect for an investigation?
✔✔2 GB - ✔✔What's the maximum file size when writing data to a FAT32 drive?
✔✔T - ✔✔The main goal of a static acquisition is the preservation of digital evidence.
(T/F)
✔✔T - ✔✔With newer Linux kernel distributions, USB devices are automatically
mounted, which can alter data on it. (T/F)
✔✔F - ✔✔FTK Imager can acquire data in a drive's host protected area. (T/F)
✔✔T - ✔✔A hashing algorithm is a program designed to create a binary or hexadecimal
number that represents the uniqueness of a data set, file, or entire disk. (T/F)
✔✔Validation - ✔✔What's the most critical aspect of digital evidence?
✔✔F - ✔✔The plain view doctrine in computer searches is well-established law. (T/F)
✔✔1 - ✔✔As a private-sector investigator, you can become an agent of law
enforcement when which of the following happens?
1. You begin to take orders from a police detective without a warrant or subpoena.
2. Your internal investigation has concluded, and you have filed a criminal complaint
and turned over the evidence to law enforcement.
3. Your internal investigation begins.
4. None of the above.
✔✔T - ✔✔Commingling evidence means that sensitive or confidential information being
mixed with data collected as evidence. (T/F)
✔✔T - ✔✔If a company doesn't distribute a computing use policy stating an employer's
right to inspect employees' computers freely, including e-mail and Web use, employees
have an expectation of privacy. (T/F)
✔✔Ntuser.dat - ✔✔Which of the following Windows 8 files contains user-specific
information?
✔✔Unicode characters and better security - ✔✔List two features NTFS has that FAT
does not.
