MCFE Exam Module 2 (Evidence Processing and Case Creation) With
Complete Solutions 100% Verified
T or F: Rather than use a separate tool to image the data and then another to perform
the processing, AXIOM Process combines the two steps. - ANSWER True.
*Imaging the device with AXIOM Process may not be required if an image was already
acquired with a different tool*
Besides showing the parsed artifacts from a data source, AXIOM Examine also includes
what to find and review even more data? - ANSWER A case dashboard, artifacts
explorer, registry explorer, file system explorer, timeline explorer, connections
explorer, and media explorer
For your work station, you should choose storage options based on your needs
considering: - ANSWER - the number of cases you work per year
the amount of data being stored
Separating your case files from your evidence files on physical media will allow you to
obtain a significant improvement in: - ANSWER The responsiveness and speed of
processing and examining your cases
How would you modify the Temporary File Location settings in AXIOM Process, and what
does it do? - ANSWER Tools --->Settings in the toolbar. Select Custom Location rather
than Case Folder as the location.
The goal is to facilitate processing speed of your cases in being assured you are not
maxing out your IOPS, a term meaning, 'the number of Input/Output Operations Per
Second', on physical disk usage.
What does IOPS stand for? - ANSWER Input/output operations per second
Axiom case files are stored with what extension? - ANSWER.MFDB
, What type of databases are AXIOM case files stored on the physical disks? -ANSWER
SQL Databases
The number of reads and writes to that database, as well as reads from the evidence
files will cause you to reach the physical limitation of your physical disks on most
high-speed modern computers
What type of drive is recommended to use for physical storage of case files, if budget is
of no concern? ANSWER NVME Drives
- A single samsung 960 NVME drive maintains 330,000 IOPS per physical disk and when
raided together in a RAID 0 configuration you can expect about 900,000 IOPS
When processing in Magnet AXIOM Process, the CPU of the machine is a key factor in
determining the: - ANSWER Speed of processing
AXIOM Process can create up to _______ threads of processing, one for each core of the
machine. - ANSWER 32
T or F: AXIOM will only take advantage of one physical processing unit at a time. -
ANSWER True
- the more threads that Magnet AXIOM Process uses the more the RAM of the system
has got to keep up with dispatching work to each of those threads
Users will realize a dramatic performance increase up until 8 or 12 Cores, and beyond
12 Cores, the: - ANSWER velocity of the core takes precedence in performance
enhancements
When AXIOM Process is first opened users have two options: - ANSWER 1. Create new
case
2. Navigate to a case
What is the final button you will click within AXIOM Process after you have added
evidence sources? - ANSWER ANALYZE EVIDENCE
Complete Solutions 100% Verified
T or F: Rather than use a separate tool to image the data and then another to perform
the processing, AXIOM Process combines the two steps. - ANSWER True.
*Imaging the device with AXIOM Process may not be required if an image was already
acquired with a different tool*
Besides showing the parsed artifacts from a data source, AXIOM Examine also includes
what to find and review even more data? - ANSWER A case dashboard, artifacts
explorer, registry explorer, file system explorer, timeline explorer, connections
explorer, and media explorer
For your work station, you should choose storage options based on your needs
considering: - ANSWER - the number of cases you work per year
the amount of data being stored
Separating your case files from your evidence files on physical media will allow you to
obtain a significant improvement in: - ANSWER The responsiveness and speed of
processing and examining your cases
How would you modify the Temporary File Location settings in AXIOM Process, and what
does it do? - ANSWER Tools --->Settings in the toolbar. Select Custom Location rather
than Case Folder as the location.
The goal is to facilitate processing speed of your cases in being assured you are not
maxing out your IOPS, a term meaning, 'the number of Input/Output Operations Per
Second', on physical disk usage.
What does IOPS stand for? - ANSWER Input/output operations per second
Axiom case files are stored with what extension? - ANSWER.MFDB
, What type of databases are AXIOM case files stored on the physical disks? -ANSWER
SQL Databases
The number of reads and writes to that database, as well as reads from the evidence
files will cause you to reach the physical limitation of your physical disks on most
high-speed modern computers
What type of drive is recommended to use for physical storage of case files, if budget is
of no concern? ANSWER NVME Drives
- A single samsung 960 NVME drive maintains 330,000 IOPS per physical disk and when
raided together in a RAID 0 configuration you can expect about 900,000 IOPS
When processing in Magnet AXIOM Process, the CPU of the machine is a key factor in
determining the: - ANSWER Speed of processing
AXIOM Process can create up to _______ threads of processing, one for each core of the
machine. - ANSWER 32
T or F: AXIOM will only take advantage of one physical processing unit at a time. -
ANSWER True
- the more threads that Magnet AXIOM Process uses the more the RAM of the system
has got to keep up with dispatching work to each of those threads
Users will realize a dramatic performance increase up until 8 or 12 Cores, and beyond
12 Cores, the: - ANSWER velocity of the core takes precedence in performance
enhancements
When AXIOM Process is first opened users have two options: - ANSWER 1. Create new
case
2. Navigate to a case
What is the final button you will click within AXIOM Process after you have added
evidence sources? - ANSWER ANALYZE EVIDENCE
