SANS 500 EVALUATION TEST ANSWERS AND
QUESTIONS SET A+
✔✔working S0 - ✔✔System power state where the system is fully functional. Some
hardware components can be placed into low-power state when not being used to save
power
✔✔Sleep S0 - ✔✔System power state that can quickly switch from a low power state to
a high power state, so that it can respond quickly to hardware and network events
✔✔Sleep 1, 2, 3 - ✔✔System power state where enough power is trickled into RAM to
keep the system state maintained. SoC components remain powered.
✔✔Hibernate S4 - ✔✔System power state with hibernation file
✔✔Shutdown S5 - ✔✔System power state off
✔✔Mechanical Off-G3 - ✔✔System power state where completly shutdown and
consuming no power
✔✔DRIPS - ✔✔Deepest Runtime Idle Platform State
✔✔Encrypted Disk Detector - edd.exe - ✔✔Command line tool that checks the local
physical drives on a system for TrueCrypt, PGP, Bitlocker, SafeBoot, BestCrypt,
Checkpoint, Sophos, or Symantex encrypted volumes.
✔✔DumpIT - ✔✔Forensic tool for RAM Aquisition
✔✔KAPE Triage VHDX Creation - ✔✔Forensic tool for creating a quick triage image
✔✔$MFT - Master File Table - ✔✔index of every file and folder on the system
QUESTIONS SET A+
✔✔working S0 - ✔✔System power state where the system is fully functional. Some
hardware components can be placed into low-power state when not being used to save
power
✔✔Sleep S0 - ✔✔System power state that can quickly switch from a low power state to
a high power state, so that it can respond quickly to hardware and network events
✔✔Sleep 1, 2, 3 - ✔✔System power state where enough power is trickled into RAM to
keep the system state maintained. SoC components remain powered.
✔✔Hibernate S4 - ✔✔System power state with hibernation file
✔✔Shutdown S5 - ✔✔System power state off
✔✔Mechanical Off-G3 - ✔✔System power state where completly shutdown and
consuming no power
✔✔DRIPS - ✔✔Deepest Runtime Idle Platform State
✔✔Encrypted Disk Detector - edd.exe - ✔✔Command line tool that checks the local
physical drives on a system for TrueCrypt, PGP, Bitlocker, SafeBoot, BestCrypt,
Checkpoint, Sophos, or Symantex encrypted volumes.
✔✔DumpIT - ✔✔Forensic tool for RAM Aquisition
✔✔KAPE Triage VHDX Creation - ✔✔Forensic tool for creating a quick triage image
✔✔$MFT - Master File Table - ✔✔index of every file and folder on the system
