ACE Cheat Sheet 2026

The 30 highest-yield ACE facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the purpose of volatility analysis in digital forensics? → Recover memory-based artifacts
2. Under HIPAA, what is the maximum civil penalty per violation category when the covered entity demonstrates willful neglect and fails to correct the violation? → $1,900,000
3. An ACE trainer working at a gym learns that a colleague is practicing outside their scope by diagnosing injuries. The trainer should: → Address the concern with the colleague and/or facility management
4. Which file system metadata attribute records the last time a file's content was modified on NTFS? → Last Written time ($STANDARD_INFORMATION)
5. International digital investigations are complicated primarily because: → Data privacy laws and mutual legal assistance treaty (MLAT) requirements vary by country
6. What is 'sparse acquisition' in the context of mobile device forensics? → Imaging only non-empty, allocated regions of storage to reduce image size
7. What does the Windows 'UserAssist' registry key track, and how is its data encoded? → GUI-based program execution history with run counts and timestamps, encoded in ROT13
8. Which FTK feature allows an examiner to index and search the full text content of files across an entire forensic image? → Full Text Index (FTI)
9. An examiner is asked by media to comment on an ongoing investigation. The appropriate response is to: → Decline and direct inquiries to the agency or attorney handling the case
10. Which file system artifact is MOST useful for proving a USB drive was connected to a Windows system even if the drive has been removed? → USBSTOR registry keys and Windows Event Log entries on the host
11. What is 'file carving' in digital forensics? → Recovering files based on file signatures without relying on file system metadata
12. When writing a forensic report, which section should describe the investigator's methodology and tools used during examination? → Examination Methodology
13. In risk management, the term 'residual risk' refers to: → The risk that remains after all controls have been applied
14. What should be the first action when a new regulation is enacted that affects your practice? → Review the regulation, assess its impact, and develop an implementation plan
15. Which of the following correctly describes the order of volatility from MOST to LEAST volatile? → CPU registers → RAM → network state → hard disk
16. Which hashing algorithm is currently recommended for verifying forensic image integrity due to its collision resistance? → SHA-256
17. In AccessData FTK, what is a 'bookmark' used for? → Marking and annotating items of interest for inclusion in reports
18. What is the role of documentation in regulatory compliance? → It provides verifiable evidence that standards are being met
19. What type of password attack attempts every possible combination of characters up to a specified length? → Brute force attack
20. During NTFS forensics in FTK, what critical information is stored in the Master File Table (MFT) that aids an investigation? → File metadata including timestamps, permissions, file names, and attribute data
21. What is the primary goal of digital forensics? → Preserve and analyze digital evidence
22. Which of the following best describes 'slack space' in digital forensics? → Space between the end of a file and the end of its last cluster
23. When analyzing Windows Event Logs in FTK, which Event ID is most significant for proving interactive user logon to a system? → Event ID 4624 with Logon Type 2 or 10
24. Which of the following best describes 'volatile data' in a forensic investigation? → Data that is lost when power is removed from a system
25. When performing a forensic acquisition, why is it important to document the hash value both before and after imaging? → To prove the forensic copy is an exact, unaltered duplicate of the original
26. Which practice best ensures consistency in forensic documentation across multiple examiners within an organization? → Adopting standardized report templates and documentation procedures
27. Which of the following BEST describes the role of professional development in maintaining quality as an ACE-certified personal trainer? → It ensures trainers integrate current evidence-based practices into client programming
28. In AccessData's Password Recovery Toolkit (PRTK), what is a 'dictionary attack with rules' primarily designed to do? → Apply transformations like capitalization and number substitution to dictionary words
29. A trainer notices a client is using anabolic steroids. The trainer's most appropriate action is to: → Educate the client about health risks and refer to a physician
30. Which action by an ACE trainer best exemplifies the principle of 'fidelity'? → Consistently arriving on time and honoring all scheduled client appointments