AccessData Certified Examiner (ACE) — Questions and Answers

Question 1: What does the Windows 'UserAssist' registry key track, and how is its data encoded?

Active network adapter settings, stored in plain text
GUI-based program execution history with run counts and timestamps, encoded in ROT13 (Correct answer)
Recently connected USB devices, encoded in Base64
Recently printed documents, encoded in hexadecimal

Correct answer: GUI-based program execution history with run counts and timestamps, encoded in ROT13

UserAssist entries, stored ROT13-encoded under HKCU, record the history of programs launched through Windows Explorer including execution counts and last-run timestamps.

Question 2: Which communication style is most effective in ACORD Certified Expert professional settings?

Indirect and vague
Passive and avoidant
Assertive and respectful (Correct answer)
Aggressive and demanding

Correct answer: Assertive and respectful

Assertive communication expresses ideas clearly and respectfully while maintaining professional boundaries and mutual respect.

Question 3: A trainer is approached to endorse a weight-loss supplement on social media. Under ACE ethics, the trainer must:

Only endorse if they personally use the product
Ensure any endorsement is truthful, evidence-based, and discloses the commercial relationship (Correct answer)
Accept if the product is sold in health food stores
Refuse all endorsements regardless of product quality

Correct answer: Ensure any endorsement is truthful, evidence-based, and discloses the commercial relationship

ACE ethics require that endorsements be truthful, substantiated, and that commercial relationships be disclosed to the public.

Question 4: When examining a BitLocker-encrypted drive, which of the following is the most examiner-friendly recovery method if the recovery key is unavailable?

Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key (Correct answer)
Imaging the encrypted volume and processing it directly in FTK
Running a GPU-accelerated brute force attack against the volume header
Disabling BitLocker through the Windows RE environment

Correct answer: Searching the Microsoft account or Active Directory for the stored BitLocker Recovery Key

BitLocker recovery keys are automatically backed up to Microsoft accounts or Active Directory, making this the fastest and most reliable recovery path for examiners.

Question 5: Which of the following best describes 'live acquisition' in digital forensics?

Imaging a powered-off device using a write blocker
Cloning a hard drive in the lab
Restoring data from a cloud backup
Collecting volatile data from a running system before shutdown (Correct answer)

Correct answer: Collecting volatile data from a running system before shutdown

Live acquisition involves capturing volatile data (RAM, network connections, running processes) from a powered-on system, which would be lost upon shutdown.

Question 6: Which of the following correctly describes the order of volatility from MOST to LEAST volatile?

Hard disk → RAM → CPU registers → network state
RAM → hard disk → CPU registers → optical media
CPU registers → RAM → network state → hard disk (Correct answer)
Network state → optical media → RAM → CPU registers

Correct answer: CPU registers → RAM → network state → hard disk

CPU registers and cache are the most volatile, followed by RAM, network state, then persistent storage like hard disks and optical media.

Question 7: When analyzing Windows Event Logs in FTK, which Event ID is most significant for proving interactive user logon to a system?

Event ID 7036
Event ID 1102
Event ID 4624 with Logon Type 2 or 10 (Correct answer)
Event ID 4625

Correct answer: Event ID 4624 with Logon Type 2 or 10

Event ID 4624 records successful logons; Logon Type 2 indicates interactive (console) logon and Type 10 indicates remote interactive (RDP) logon, both proving direct user access.

Question 8: What type of traffic does a packet sniffer capture during network forensic analysis?

Exclusively DNS query and response messages
Only HTTPS-encrypted web traffic streams
Only wireless beacon and management frames
Raw network packets traversing the monitored network interface (Correct answer)

Correct answer: Raw network packets traversing the monitored network interface

A packet sniffer captures all raw packets at the network interface level, providing complete visibility into communications regardless of protocol.

Question 9: An investigator is responding to a ransomware incident. Which evidence should be collected BEFORE isolating the infected system from the network?

Email archive PST files
File system directory listings
Installed software registry keys
Network connections, active processes, and running memory to identify encryption keys (Correct answer)

Correct answer: Network connections, active processes, and running memory to identify encryption keys

Active network connections and RAM may contain the ransomware's encryption keys or C2 communication data that disappears upon network isolation or shutdown.

Question 10: What is the function of a write blocker in forensic investigations?

Compress evidence for storage
Speed up the copying of files
Prevent modifications to digital evidence (Correct answer)
Remove duplicate data automatically

Correct answer: Prevent modifications to digital evidence

The primary function of a write blocker in forensic investigations is to physically or logically prevent any data from being written to the original digital evidence source. This ensures that the integrity of the evidence is maintained during the acquisition and examination process, preventing accidental or intentional alteration. Write blockers are crucial for adhering to the principle of non-alteration of evidence.

Question 11: In risk management, the term 'residual risk' refers to:

The risk that remains after all controls have been applied (Correct answer)
The risk accepted without any controls
The risk transferred to an insurer
The initial risk before any mitigation

Correct answer: The risk that remains after all controls have been applied

Residual risk is the level of risk that remains after security controls and mitigation measures have been implemented.

Question 12: A client offers the trainer a percentage commission for recommending a specific supplement brand. This is an example of:

Standard industry practice requiring no action
Scope expansion into retail
A conflict of interest that should be disclosed to the client (Correct answer)
Acceptable entrepreneurship

Correct answer: A conflict of interest that should be disclosed to the client

Financial arrangements tied to product recommendations create conflicts of interest that must be disclosed to maintain client trust.

Question 13: What is the purpose of using a Faraday bag during mobile device acquisition?

Prevent electrostatic discharge from damaging the device
Block wireless signals to prevent remote wipe commands (Correct answer)
Keep the device charged during transport
Compress file system data for storage

Correct answer: Block wireless signals to prevent remote wipe commands

A Faraday bag blocks cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe or data modification commands from reaching the device.

Question 14: Which FTK search capability enables examiners to locate structured data patterns like SSNs or credit card numbers across all evidence?

Regular expression (regex) search (Correct answer)
Known File Filter (KFF) hash matching
Bookmark export and review
Evidence image mounting

Correct answer: Regular expression (regex) search

FTK supports regular expression searches, allowing examiners to define patterns such as \d{3}-\d{2}-\d{4} to locate Social Security numbers or similar structured data across all evidence.

Question 15: A forensic examiner discovers evidence on a corporate server that may relate to insider trading. Which regulatory body's guidelines would most directly govern the handling and reporting of this financial evidence?

FINRA
SEC (Correct answer)
FDIC
OCC

Correct answer: SEC

The SEC (Securities and Exchange Commission) has primary jurisdiction over insider trading violations and governs evidence handling in related investigations.

Question 16: Which AccessData tool is specifically designed for enterprise-scale evidence collection across networked endpoints without physical access?

FTK Enterprise / AD Enterprise (Correct answer)
Registry Viewer
PRTK (Password Recovery Toolkit)
FTK Imager

Correct answer: FTK Enterprise / AD Enterprise

AD Enterprise (FTK Enterprise) performs remote live acquisition and triage across networked endpoints without requiring physical removal of drives.

Question 17: What is a forensic image in digital evidence acquisition?

An exact copy of a digital device (Correct answer)
A manually edited set of files
A compressed version of select data
A summary report of important files

Correct answer: An exact copy of a digital device

A forensic image is a bit-for-bit, sector-by-sector duplicate of a digital storage device, capturing all data including active files, deleted files, and unallocated space. This exact copy serves as the working evidence for analysis, ensuring the original device remains untouched and its integrity preserved. It is fundamental for maintaining the authenticity and admissibility of digital evidence.

Question 18: In FTK, what is the purpose of the 'Known File Filter' (KFF) during evidence processing?

Identifies files by extension only
Converts proprietary formats to open formats
Compresses evidence files for storage
Flags or ignores files based on hash comparison to known good/bad libraries (Correct answer)

Correct answer: Flags or ignores files based on hash comparison to known good/bad libraries

KFF compares file hashes against databases of known good (OS/application) and known bad (malware/contraband) files to quickly triage evidence.

Question 19: A forensic examiner is called to respond to a ransomware incident. Which immediate action best mitigates further data loss risk?

Isolate affected systems from the network to prevent spread (Correct answer)
Delete all encrypted files to stop the malware
Pay the ransom to restore files quickly
Reboot all infected systems simultaneously

Correct answer: Isolate affected systems from the network to prevent spread

Network isolation prevents ransomware from propagating to additional systems while preserving the existing state for forensic analysis.

Question 20: What does analyzing DNS artifacts during network forensics help an investigator determine?

The physical location of a network switch
The hardware MAC addresses of all devices on a subnet
Which domain names a system resolved, revealing connections to websites, C2 servers, or exfiltration targets (Correct answer)
The encryption keys used in SSL/TLS sessions

Correct answer: Which domain names a system resolved, revealing connections to websites, C2 servers, or exfiltration targets

DNS resolution records show which domain names a host looked up, helping establish communications with malicious domains, C2 infrastructure, or unauthorized services.

Question 21: How does FTK analyze web browsing history from a Windows evidence image?

By examining only the Windows Event Log for browser activity
By running keyword searches on the browser executable only
By parsing browser artifact databases such as Chrome and Firefox SQLite files and IE index.dat to extract visited URLs and timestamps (Correct answer)
By reviewing only the browser's LNK shortcut files

Correct answer: By parsing browser artifact databases such as Chrome and Firefox SQLite files and IE index.dat to extract visited URLs and timestamps

FTK parses browser-specific artifact files (SQLite databases for Chrome/Firefox, index.dat for IE) to reconstruct browsing history with URLs and timestamps.

Question 22: Which FTK Imager feature is used to acquire a live memory dump from a running Windows system?

Capture Memory (Correct answer)
Create Disk Image
Add Evidence Item
Mount Image to Drive Letter

Correct answer: Capture Memory

FTK Imager's 'Capture Memory' option acquires the contents of RAM from a running system and writes it to a .mem or .dmp file for offline analysis.

Question 23: Why is the Windows pagefile (pagefile.sys) forensically significant?

It records a log of all file access operations
It holds memory pages swapped from RAM to disk, potentially including process data, fragments of documents, and passwords (Correct answer)
It contains the user's complete browsing history
It stores encrypted copies of the SAM database

Correct answer: It holds memory pages swapped from RAM to disk, potentially including process data, fragments of documents, and passwords

The pagefile contains RAM pages that were swapped to disk, preserving volatile data fragments even after the system is shut down.

Question 24: An examiner is reviewing LNK (shortcut) files in FTK to track recently accessed documents. Which artifact within a LNK file is MOST valuable for this purpose?

The LNK file's own creation timestamp on the evidence drive
The Windows SID of the user who created the shortcut
The target file's MAC timestamps, volume serial number, and original path embedded in the LNK (Correct answer)
The shortcut's icon resource path

Correct answer: The target file's MAC timestamps, volume serial number, and original path embedded in the LNK

LNK files embed the target file's MAC timestamps, volume information, and original path, providing evidence of when and where a document was accessed even if the original is deleted.

Question 25: What is the appropriate action when discovering a colleague has violated professional standards?

Handle it privately without documentation
Report through proper channels as outlined in the code of ethics (Correct answer)
Post about it on social media
Ignore it to maintain the relationship

Correct answer: Report through proper channels as outlined in the code of ethics

Professional standards require reporting violations through proper channels to protect the public and maintain the integrity of the profession.

Question 26: What does FTK's 'Known File Filter' (KFF) contribute to a password recovery workflow?

It automatically decrypts files that match known encryption signatures
It flags files whose hash matches known malware databases
It identifies files that have been renamed to hide their extension
It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files (Correct answer)

Correct answer: It excludes known benign files from processing, allowing the examiner to focus on unknown or suspect encrypted files

KFF filters out known-good files (e.g., OS and application files), reducing the dataset so examiners concentrate password recovery efforts on genuinely unknown, potentially relevant encrypted files.

Question 27: In FTK, when a file is flagged as 'encrypted' after processing, what does this determination typically rely on?

The file being located in a system-protected directory
The file extension matching a known encrypted format list
The file owner's account being marked as restricted
File header signatures, entropy analysis, and known encryption format identification (Correct answer)

Correct answer: File header signatures, entropy analysis, and known encryption format identification

FTK combines file signature recognition, known encryption format headers, and high-entropy measurements to identify encrypted files, rather than relying solely on extensions.

Question 28: In FTK, when performing keyword searches across evidence, what advantage does an indexed search provide over a live search?

Indexed search is significantly faster because terms are pre-processed into a searchable index during evidence processing (Correct answer)
Indexed search can find encrypted content
Live search is always more accurate than indexed search
Indexed search automatically translates foreign language content

Correct answer: Indexed search is significantly faster because terms are pre-processed into a searchable index during evidence processing

FTK builds a full-text index during processing, allowing indexed searches to complete in seconds by querying the pre-built index rather than scanning raw evidence data.

Question 29: During risk mitigation planning, a forensic lab decides to stop using a vulnerable legacy imaging tool entirely. This is an example of:

Risk acceptance
Risk avoidance (Correct answer)
Risk transference
Risk reduction

Correct answer: Risk avoidance

Risk avoidance eliminates the activity or tool that introduces the risk, removing exposure entirely rather than reducing or transferring it.

Question 30: A fitness director asks trainers to track client dropout rates by program type. This data collection effort PRIMARILY aims to:

Calculate trainer commissions based on client retention
Satisfy ACE accreditation reporting requirements
Pinpoint program weaknesses contributing to client attrition (Correct answer)
Identify which programs need marketing improvements

Correct answer: Pinpoint program weaknesses contributing to client attrition

Tracking dropout rates by program type is a quality assurance strategy to identify which programs may be ineffective, inaccessible, or misaligned with client needs.

Question 31: What is a rule-based (or hybrid) attack in PRTK?

Splitting a brute force attack across multiple processors
Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates (Correct answer)
Using known plaintext to derive the encryption key
Combining two dictionary files into a single wordlist

Correct answer: Applying transformation rules (e.g., capitalize, append numbers) to dictionary words to generate candidates

A rule-based attack applies mutations — such as capitalization, substitution, or appending digits — to dictionary entries to cover predictable password patterns.

Question 32: What type of password attack attempts every possible combination of characters up to a specified length?

Rainbow table attack
Dictionary attack
Brute force attack (Correct answer)
Rule-based attack

Correct answer: Brute force attack

A brute force attack systematically tries all possible character combinations, guaranteeing eventual success but requiring significant time and resources.

Question 33: During a forensic examination, an examiner discovers high-entropy data scattered in unallocated space with no file header. This most likely indicates:

Evidence of secure file wiping using overwrite patterns
Operating system swap file contents
Remnants of encrypted or compressed file data from deleted files (Correct answer)
A fragmented but intact plaintext document

Correct answer: Remnants of encrypted or compressed file data from deleted files

High entropy in unallocated space without recognizable headers typically indicates deleted encrypted or compressed file fragments that were previously allocated to protected files.

Question 34: What is the primary objective of evidence acquisition in digital forensics?

Collect digital data without altering integrity (Correct answer)
Erase unnecessary files to save space
Convert evidence to a different format for convenience
Modify evidence to make it admissible

Correct answer: Collect digital data without altering integrity

The primary objective of evidence acquisition in digital forensics is to collect all relevant digital data in a way that absolutely preserves its original state and integrity. This means using specialized tools and techniques to create exact copies without making any changes to the source device or files. Maintaining integrity is paramount for the evidence to be admissible in legal proceedings.

Question 35: When imaging an SSD with TRIM enabled, which limitation must an examiner understand?

SSDs require a different hashing algorithm than HDDs
TRIM may have zeroed deleted sectors, making carving of deleted files less effective (Correct answer)
SSD images cannot be stored in E01 format
Write-blockers do not function on SATA SSDs

Correct answer: TRIM may have zeroed deleted sectors, making carving of deleted files less effective

TRIM actively zeroes sectors marked as deleted, potentially destroying data that would be recoverable from a traditional HDD's unallocated space.

Question 36: Which cloud acquisition scenario presents the greatest legal complexity for a forensic examiner?

Acquiring data from a locally-synced cloud folder on a seized laptop
Obtaining data directly from a cloud provider's servers across international jurisdictions (Correct answer)
Imaging a locally-attached USB drive containing cloud backup files
Extracting cached cloud files from browser history

Correct answer: Obtaining data directly from a cloud provider's servers across international jurisdictions

Cross-border cloud data requests require compliance with international laws (e.g., GDPR, MLAT treaties), making them legally complex beyond domestic warrant authority.

Question 37: During evidence packaging, which labeling information is LEAST critical to include on the evidence bag?

Collector's name and badge/employee number
The retail purchase price of the device (Correct answer)
Case number and date/time of collection
Description of the item and its collection location

Correct answer: The retail purchase price of the device

The retail price of a device has no bearing on chain of custody or evidence identification; all other fields are required for proper documentation.

Question 38: Which Windows Security Event ID indicates a successful user account logon?

Event ID 4688
Event ID 4625
Event ID 1102
Event ID 4624 (Correct answer)

Correct answer: Event ID 4624

Windows Security Event ID 4624 is logged each time a user account successfully authenticates and establishes a logon session.

Question 39: When analyzing Windows Registry hives in FTK, which hive contains recently accessed files and user-specific application settings?

SYSTEM
NTUSER.DAT (Correct answer)
SECURITY
SAM

Correct answer: NTUSER.DAT

NTUSER.DAT is the per-user registry hive stored in each user's profile directory and contains MRU lists, recently accessed documents, and user-specific settings.

Question 40: According to the order of volatility, which data source must be collected FIRST at a live scene?

Log files stored on disk
External hard drive image
Backup tapes in the server room
RAM/memory contents (Correct answer)

Correct answer: RAM/memory contents

RAM is the most volatile data source and must be captured before any other action, as it is destroyed immediately when the system loses power.

Question 41: What forensic value does the Windows hiberfil.sys file provide?

It holds browser session cookies from the last active user session
It contains a compressed snapshot of RAM from the last system hibernation event (Correct answer)
It logs all application crashes and error codes
It stores a backup of the Windows registry hives

Correct answer: It contains a compressed snapshot of RAM from the last system hibernation event

Hiberfil.sys stores a compressed image of RAM contents saved during hibernation, serving as a partial memory dump available for offline forensic analysis.

Question 42: What is 'sparse acquisition' in the context of mobile device forensics?

Acquiring only the SIM card data
Acquiring data over a slow Bluetooth connection
Extracting only deleted files using carving
Imaging only non-empty, allocated regions of storage to reduce image size (Correct answer)

Correct answer: Imaging only non-empty, allocated regions of storage to reduce image size

Sparse acquisition skips empty (zeroed) sectors and records only blocks with actual data, significantly reducing image size for large-capacity devices.

Question 43: When acquiring evidence from a live system, which method best preserves volatile memory that would be lost on shutdown?

Power off immediately and image the drive
Create a static disk image only
Clone the hard drive using a write-blocker
Perform a RAM dump before any disk imaging (Correct answer)

Correct answer: Perform a RAM dump before any disk imaging

RAM dump captures volatile memory contents (running processes, encryption keys, network connections) that are destroyed when power is removed.

Question 44: What is write-blocking and why is it critical during forensic acquisition?

It encrypts the forensic image during transfer
It speeds up read operations by caching sectors
It compresses data during imaging to save space
It prevents any write commands from reaching the evidence drive, preserving its original state (Correct answer)

Correct answer: It prevents any write commands from reaching the evidence drive, preserving its original state

Write-blockers intercept and discard write commands at the hardware or software level, ensuring no data on the evidence drive is modified during imaging.

Question 45: What is AccessData's DNA (Distributed Network Attack) feature primarily used for?

Decrypting SSL/TLS communications
Distributing password cracking workloads across networked computers (Correct answer)
Managing distributed forensic case files
Analyzing network traffic captures

Correct answer: Distributing password cracking workloads across networked computers

DNA leverages multiple networked machines to parallelize and accelerate password recovery operations, dramatically reducing cracking time.

Question 46: A suspect's password-protected ZIP archive uses PKZIP 2.0 (ZipCrypto) encryption. Why is this considered weak from a forensic perspective?

ZipCrypto is vulnerable to known-plaintext attacks that can recover the key with as little as 12 bytes of known plaintext (Correct answer)
PKZIP 2.0 stores the password hash in the ZIP header in plaintext
ZipCrypto uses only 40-bit keys that brute force attacks can break instantly
ZipCrypto archives can be decompressed without a password using standard tools

Correct answer: ZipCrypto is vulnerable to known-plaintext attacks that can recover the key with as little as 12 bytes of known plaintext

The ZipCrypto algorithm is vulnerable to a known-plaintext attack; if an examiner has an unencrypted copy of even one file in the archive, the encryption key can be recovered rapidly.

Question 47: Under CIPA (Children's Internet Protection Act), what must schools and libraries do to receive E-rate discounts, which is relevant to forensic investigations of educational institutions?

Implement HTTPS on all school websites
Encrypt all student records at rest
Report all cybersecurity incidents to the FTC within 72 hours
Adopt technology protection measures including internet filtering (Correct answer)

Correct answer: Adopt technology protection measures including internet filtering

CIPA requires schools and libraries receiving E-rate funding to implement technology protection measures that block or filter obscene content to protect minors.

Question 48: Which Windows artifact records recently accessed files and folders and is stored in the user's AppData directory?

Volume Shadow Copies
Event logs
Prefetch files
Jump Lists and Recent Items (LNK files) (Correct answer)

Correct answer: Jump Lists and Recent Items (LNK files)

Jump Lists and LNK (shortcut) files in the user's Recent folder record recently accessed documents and applications with timestamps.

Question 49: What is a rainbow table in the context of password cracking?

A color-coded matrix for organizing password complexity rules
A precomputed table of hash values mapped to their plaintext passwords (Correct answer)
A GUI tool for visualizing password entropy
A list of leaked passwords sorted by frequency

Correct answer: A precomputed table of hash values mapped to their plaintext passwords

Rainbow tables store precomputed hash-to-plaintext mappings, enabling fast password recovery by looking up a hash rather than computing it in real time.

Question 50: A personal trainer applies the FIT principle (Frequency, Intensity, Time) inconsistently across sessions without documentation. This MOST compromises which aspect of quality care?

Emergency action plan readiness
Client confidentiality and HIPAA compliance
Reproducibility and systematic program progression (Correct answer)
Facility risk management protocols

Correct answer: Reproducibility and systematic program progression

Inconsistent and undocumented application of training variables makes systematic progression impossible, undermining program quality and reproducibility.

Question 51: Which action best demonstrates the ACE ethical standard of 'professional responsibility'?

Sharing successful client case studies without anonymizing details
Training clients beyond their fitness level to accelerate results
Offering discounts to retain clients showing signs of dropping out
Maintaining current certification, CPR/AED credentials, and continuing education (Correct answer)

Correct answer: Maintaining current certification, CPR/AED credentials, and continuing education

Professional responsibility includes keeping credentials current and pursuing ongoing education to provide competent service.

Question 52: What is key escrow, and how is it relevant to digital forensic investigations?

A hardware device that stores cryptographic keys securely
A technique for hiding encryption keys inside other files (steganography)
A legal process for compelling suspects to provide their encryption passwords
A system where encryption keys are held by a trusted third party, potentially allowing lawful access without breaking encryption (Correct answer)

Correct answer: A system where encryption keys are held by a trusted third party, potentially allowing lawful access without breaking encryption

Key escrow allows authorized parties (such as law enforcement with proper legal process) to obtain encryption keys from the holding third party, enabling decryption without cryptanalysis.

Question 53: When a forensic investigation reveals evidence of a crime during a civil case (e.g., child exploitation material found during a corporate HR investigation), what is the examiner's primary legal and ethical obligation?

Continue the civil examination and report findings only to the client attorney
Immediately stop the examination and report to law enforcement per mandatory reporting laws (Correct answer)
Complete the full forensic image before reporting to avoid evidence spoliation claims
Quarantine the evidence and await further legal instructions from the client

Correct answer: Immediately stop the examination and report to law enforcement per mandatory reporting laws

Discovery of child exploitation material (CSAM) triggers mandatory reporting obligations under 18 U.S.C. § 2258A, requiring immediate reporting to NCMEC regardless of the civil case context.

Question 54: An examiner receives a hard drive with a damaged partition table. Which FTK Imager feature allows imaging despite this condition?

Add Evidence Item → Physical Drive
Mount Image to Drive Letter
Create Disk Image with custom sector range (Correct answer)
Verify Drive/Image

Correct answer: Create Disk Image with custom sector range

Specifying a custom sector range lets the examiner image readable sectors even when the partition table is corrupt or missing.

Question 55: What critical data does RAM (volatile memory) analysis reveal that traditional disk forensics cannot?

File system allocation maps and MFT records
Running processes, active network connections, encryption keys, and decrypted data in memory (Correct answer)
Registry hive files stored on disk
Files deleted years before the acquisition

Correct answer: Running processes, active network connections, encryption keys, and decrypted data in memory

RAM analysis captures the live system state, including running processes, decrypted content, active connections, and data never written to disk.

Question 56: During a network forensics investigation, which device should be imaged FIRST to capture the most transient data?

File server hard drives
Network switches and their ARP/MAC tables (Correct answer)
Backup tape systems
Archival NAS storage

Correct answer: Network switches and their ARP/MAC tables

Switch ARP and MAC address tables are stored in volatile memory and clear rapidly, making them the most time-sensitive evidence to capture.

Question 57: Which Windows registry location stores previously connected wireless (Wi-Fi) network profiles?

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs (Correct answer)
HKLM\SAM\SAM\Domains\Account\Users
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Correct answer: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs

Windows stores Wi-Fi network history in the NetworkList registry key and WLAN AutoConfig event logs, which can reveal location history based on network associations.

Question 58: What is the difference between a 'forensic duplicate' and a 'forensic image'?

There is no difference; the terms are always interchangeable
A forensic duplicate excludes slack space; a forensic image includes it
A forensic duplicate is a hash-verified bit-for-bit copy; a forensic image is a compressed archive of active files only
A forensic image is a bit-for-bit copy stored in a container format (e.g., E01); a forensic duplicate is a physical sector-by-sector clone to another drive (Correct answer)

Correct answer: A forensic image is a bit-for-bit copy stored in a container format (e.g., E01); a forensic duplicate is a physical sector-by-sector clone to another drive

A forensic image stores the bit-for-bit copy in a container file (like E01 or DD), while a forensic duplicate is a physical sector-by-sector clone onto another physical drive.

Question 59: A suspect's laptop is found with BitLocker encryption enabled and running. What is the FIRST action an examiner should take?

Acquire a RAM dump to capture the encryption key (Correct answer)
Attach a write-blocker and image the disk
Immediately pull the power cord
Boot into a live Linux environment

Correct answer: Acquire a RAM dump to capture the encryption key

Capturing a RAM dump first recovers the BitLocker key from memory, enabling decryption; powering off would destroy the key.

Question 60: Which of the following is an example of misrepresentation that violates ACE ethical standards?

Claiming to be a licensed physical therapist while holding only an ACE certification (Correct answer)
Promoting your training approach on a personal website
Advertising a specialty area in which you hold a valid credential
Listing your ACE certification number in a client contract

Correct answer: Claiming to be a licensed physical therapist while holding only an ACE certification

Claiming licensure or credentials one does not hold constitutes fraud and a serious ethical violation.

Question 61: Which type of analysis involves examining the logical structure and content of files rather than the physical disk sectors?

Memory forensics
Logical analysis (Correct answer)
Network forensics
Physical analysis

Correct answer: Logical analysis

Logical analysis examines files and folders as presented by the file system, focusing on content and metadata rather than raw disk sectors.

Question 62: A trainer uses the same program for a sedentary 55-year-old beginner as for a 25-year-old competitive athlete. This approach MOST significantly violates which quality principle?

Individualization as a core component of quality program design (Correct answer)
Scope of practice guidelines
Emergency response protocols
ACE continuing education standards

Correct answer: Individualization as a core component of quality program design

Individualization is a fundamental quality principle; applying identical programs to clients with vastly different needs compromises safety and effectiveness.

Question 63: What does Windows Security Event ID 4625 indicate?

A failed logon attempt occurred (Correct answer)
A user account was created
A privileged service was started
An audit policy was changed

Correct answer: A failed logon attempt occurred

Event ID 4625 is logged whenever an account fails to authenticate, which is critical for detecting brute force attacks and unauthorized access attempts.

Question 64: What does 'chain of custody' mean in digital forensic investigations?

A linked list of file system clusters allocated to a file
A software dependency chain used by forensic tools
The documented, unbroken chronological record of who handled evidence, when, and under what conditions (Correct answer)
The sequence of network hops traced during a cyber investigation

Correct answer: The documented, unbroken chronological record of who handled evidence, when, and under what conditions

Chain of custody documents every person who handled the evidence and all transfers, maintaining its integrity and ensuring its admissibility in legal proceedings.

Question 65: An examiner is asked to present findings at a deposition. The most important preparation step is:

Memorizing the opposing attorney's questions
Preparing new analysis not included in the original report
Thoroughly reviewing the forensic report and supporting documentation (Correct answer)
Consulting with the suspect

Correct answer: Thoroughly reviewing the forensic report and supporting documentation

Thorough review of the existing report and documentation ensures the examiner can answer questions accurately and consistently with documented findings.

Question 66: Which provision of the USA PATRIOT Act most directly expanded law enforcement's ability to conduct surveillance and obtain records relevant to digital forensic investigations?

Section 702 — foreign intelligence collection
Section 215 — business records and tangible things (Correct answer)
Section 312 — special due diligence for correspondent accounts
Section 505 — National Security Letters

Correct answer: Section 215 — business records and tangible things

Section 215 of the PATRIOT Act authorized the FBI to compel production of 'any tangible thing' including business records relevant to foreign intelligence or terrorism investigations.

Question 67: When FTK processes email evidence in PST or OST format, which artifact provides the strongest proof of message transmission rather than mere composition?

Calendar appointment invitations
Draft folder messages
Sent Items folder with matching server message ID headers (Correct answer)
Locally stored contact cards

Correct answer: Sent Items folder with matching server message ID headers

Messages in the Sent Items folder with matching SMTP headers (Message-ID, Received fields) confirm actual transmission through a mail server, not just local drafting.

Question 68: In digital forensics, what does the legal concept of 'proportionality' as established under FRCP Rule 26(b)(1) govern?

The number of forensic examiners required per case
The ratio of hash algorithm strength to file size
The scope of ESI discovery relative to the needs of the case (Correct answer)
The encryption standard required for evidence transport

Correct answer: The scope of ESI discovery relative to the needs of the case

FRCP Rule 26(b)(1) limits discovery to ESI that is proportional to the needs of the case, considering factors like importance, amount in controversy, and burden of production.

Question 69: A corporation's acceptable use policy (AUP) is most important to digital forensics because it:

Defines chain of custody procedures for HR departments
Establishes employee notice of monitoring, reducing privacy expectations on company systems (Correct answer)
Sets the evidentiary standard for internal investigations
Determines which forensic tools are legally approved for use

Correct answer: Establishes employee notice of monitoring, reducing privacy expectations on company systems

An AUP puts employees on notice that company systems may be monitored, which significantly reduces their reasonable expectation of privacy.

Question 70: What is 'anti-forensics' in the context of digital investigations?

The process of verifying the integrity of collected evidence
Techniques used to destroy, conceal, or manipulate digital evidence to impede forensic investigations (Correct answer)
Writing court-admissible forensic examination reports
Encrypting forensic case files to maintain confidentiality

Correct answer: Techniques used to destroy, conceal, or manipulate digital evidence to impede forensic investigations

Anti-forensics encompasses methods such as file wiping, timestamp alteration, steganography, and encryption used to obstruct or invalidate forensic analysis.

Question 71: What is a forensic memory dump file used for?

Backing up NTFS MFT records
Permanently erasing sensitive files from a drive
Capturing the contents of RAM at a specific point in time for offline forensic analysis (Correct answer)
Creating a verified bit-for-bit copy of a hard disk

Correct answer: Capturing the contents of RAM at a specific point in time for offline forensic analysis

A memory dump is a snapshot of RAM contents at the moment of acquisition, enabling offline analysis of volatile artifacts that would otherwise be lost.

Question 72: What is the primary reason an examiner creates both MD5 and SHA-1 hashes for a forensic image?

MD5 verifies file names while SHA-1 verifies content
Dual hashing provides defense against hash collision attacks and strengthens integrity proof (Correct answer)
Courts require both algorithms by statute
FTK only accepts dual-hash images

Correct answer: Dual hashing provides defense against hash collision attacks and strengthens integrity proof

Using two independent algorithms makes it computationally infeasible for an attacker to craft a collision that matches both, strengthening admissibility arguments.

Question 73: A client asks their trainer to falsify their attendance records for insurance reimbursement purposes. The trainer should:

Comply if the client insists it is common practice
Consult with the gym manager before deciding
Ask the client to sign a liability waiver first
Refuse, as falsifying records is unethical and potentially illegal (Correct answer)

Correct answer: Refuse, as falsifying records is unethical and potentially illegal

Falsifying records is fraud, violating both ACE ethical standards and potentially federal law.

Question 74: In FTK's email analysis, which artifact from a Microsoft Outlook PST file is most valuable for establishing a timeline of suspect communications?

Individual email sent and received timestamps stored in the message properties (Correct answer)
The OST synchronization log
The Outlook profile registry key last write time
The PST file's last modified timestamp on disk

Correct answer: Individual email sent and received timestamps stored in the message properties

Individual message properties within a PST store precise sent and received timestamps that are more reliable for timeline reconstruction than file system metadata.

Question 75: What constitutes a conflict of interest in professional practice?

When personal interests could improperly influence professional judgment (Correct answer)
When a client requests a service outside normal hours
When two colleagues disagree on a procedure
When multiple projects have the same deadline

Correct answer: When personal interests could improperly influence professional judgment

A conflict of interest occurs when personal, financial, or other interests could compromise or appear to compromise professional objectivity and judgment.

Question 76: What is the forensic significance of a password found in the Windows Credential Manager or DPAPI-protected storage?

It must be decrypted separately using a different DPAPI key before it can be used
It only applies to domain accounts and is irrelevant for local account investigations
It is stored in an irreversible hash format and cannot be recovered in plaintext
It may provide the actual password used for encrypted files, websites, or network shares without requiring cracking (Correct answer)

Correct answer: It may provide the actual password used for encrypted files, websites, or network shares without requiring cracking

Windows Credential Manager and DPAPI often store passwords in a form recoverable with the user's account credentials, providing plaintext passwords that can directly unlock encrypted resources.

Question 77: In FTK, what is the function of 'evidence processing' after an image is added?

It indexes file content, expands containers, and performs hash lookups for rapid analysis (Correct answer)
It automatically deletes temp files from the image
It duplicates the evidence image to a second drive
It converts the image to DD format for compatibility

Correct answer: It indexes file content, expands containers, and performs hash lookups for rapid analysis

Evidence processing in FTK extracts metadata, indexes text, cracks common hashes, expands archives, and carves deleted files to prepare evidence for analysis.

Question 78: What is the primary forensic value of Windows Event Logs?

They provide a chronological record of system events including logons, service starts, and security actions (Correct answer)
They store a copy of all files created on the system
They contain the full content of deleted files
They record every keystroke entered by users

Correct answer: They provide a chronological record of system events including logons, service starts, and security actions

Windows Event Logs (Security, System, Application) record timestamped system events that enable forensic reconstruction of activity timelines.

Question 79: What is a fundamental principle of Advanced Techniques & Methods in ACORD Certified Expert practice?

Working in isolation without guidance
Ignoring industry guidelines
Using outdated methods
Following established standards and best practices (Correct answer)

Correct answer: Following established standards and best practices

Following established standards and best practices ensures quality and consistency in Advanced Techniques & Methods.

Question 80: In the context of AccessData FTK, what does the 'Cerberus' malware analysis module provide?

Automated behavioral and static analysis of suspect executables to detect malware characteristics (Correct answer)
Real-time monitoring of running processes
Network traffic decryption
Brute-force decryption of encrypted containers

Correct answer: Automated behavioral and static analysis of suspect executables to detect malware characteristics

Cerberus performs automated malware triage on executable files using static analysis (PE structure, imports, strings) and behavioral indicators without requiring detonation.

Question 81: What is a key performance indicator (KPI) in quality management?

A theoretical ideal that can never be measured
A financial budget line item
A subjective opinion from management
A measurable value that demonstrates how effectively objectives are being achieved (Correct answer)

Correct answer: A measurable value that demonstrates how effectively objectives are being achieved

KPIs are quantifiable measurements that demonstrate how effectively an organization or process is achieving its key quality objectives.

Question 82: What is the primary purpose of documenting the password recovery methodology in the forensic report?

To establish the scientific validity and repeatability of the technique used, supporting admissibility of the decrypted evidence (Correct answer)
To inform the suspect of the methods used so they can challenge the results
To ensure the opposing expert can replicate the exact wordlist used
To comply with AccessData licensing requirements for PRTK usage

Correct answer: To establish the scientific validity and repeatability of the technique used, supporting admissibility of the decrypted evidence

Documenting methodology demonstrates that the recovery process was sound, repeatable, and scientifically valid — essential for evidence admissibility and withstanding expert scrutiny in court.

Question 83: In FTK, what is the purpose of the 'Detailed Options' hash verification step during evidence processing?

To index only image files while skipping documents
To automatically redact sensitive data from the evidence set
To compress evidence files before storage
To compute and record cryptographic hash values (MD5/SHA-1) of evidence items to verify integrity throughout the investigation (Correct answer)

Correct answer: To compute and record cryptographic hash values (MD5/SHA-1) of evidence items to verify integrity throughout the investigation

FTK computes MD5 and SHA-1 hashes during evidence processing to create a verifiable integrity baseline, confirming that evidence has not been altered.

Question 84: The 'business records exception' to the hearsay rule (FRE 803(6)) allows digital records to be admitted when:

The original file hash matches a known good database
They were created by a government agency
They are authenticated by a certified forensic examiner
They were kept in the course of a regularly conducted business activity and it was the regular practice to make such records (Correct answer)

Correct answer: They were kept in the course of a regularly conducted business activity and it was the regular practice to make such records

FRE 803(6) permits business records if made in the regular course of business, at or near the time of the event, by someone with knowledge.

Question 85: Which U.S. regulation requires financial institutions to file a Suspicious Activity Report (SAR) within 30 days of detecting a transaction that may involve money laundering, and is relevant when forensic findings reveal illicit financial flows?

Sarbanes-Oxley Act
Dodd-Frank Act
Fair Credit Reporting Act
Bank Secrecy Act (BSA) / FinCEN regulations (Correct answer)

Correct answer: Bank Secrecy Act (BSA) / FinCEN regulations

The Bank Secrecy Act, enforced through FinCEN regulations, requires financial institutions to file SARs within 30 days of detecting suspicious transactions that may involve money laundering or other crimes.

Question 86: An examiner finds a VeraCrypt-encrypted container on a suspect's drive. What is the most practical forensic approach when no password is known?

Use FTK's built-in VeraCrypt decryption module
Immediately image the container and submit it for brute force cracking
Search the system for passwords in plaintext artifacts (browser saved passwords, text files, registry) before attempting cracking (Correct answer)
Declare the evidence unrecoverable and document the encrypted container

Correct answer: Search the system for passwords in plaintext artifacts (browser saved passwords, text files, registry) before attempting cracking

Before resource-intensive cracking, examiners should search the broader system for password hints or reuse in artifacts like browser stores, documents, or registry keys, which often succeeds faster.

Question 87: What is the purpose of maintaining a chain of custody in evidence handling?

Allow anyone to access the evidence freely
Prevent tampering and maintain documentation (Correct answer)
Speed up the forensic process by skipping documentation
Modify evidence to match investigation needs

Correct answer: Prevent tampering and maintain documentation

Maintaining a chain of custody is essential in evidence handling to document every person who has had possession of the evidence, when, and for what purpose. This meticulous record-keeping prevents unauthorized access or tampering, ensuring the evidence's integrity and authenticity. A broken chain of custody can render evidence inadmissible in court, undermining the entire investigation.

Question 88: A risk assessment reveals that an outdated forensic tool has a known vulnerability exploitable via USB input. The vendor no longer supports the tool. Which is the BEST mitigation?

Report the vulnerability to the vendor and wait for a patch
Apply compensating controls such as disabling USB ports and air-gapping the workstation (Correct answer)
Continue using the tool with additional antivirus scans
Document the risk and accept it without further action

Correct answer: Apply compensating controls such as disabling USB ports and air-gapping the workstation

When patching is not possible, compensating controls like disabling USB ports and air-gapping the system reduce exposure without replacing the unsupported tool.

AccessData Certified Examiner (ACE)

The ACE certification validates a digital forensic examiner's proficiency with AccessData's forensic tools including FTK, FTK Imager, Registry Viewer, and Password Recovery Toolkit. It covers evidence acquisition, artifact analysis, network/memory forensics, and legal compliance.

Questions

90 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

training.exterro.com — Test delivery, eligibility, fees, exam format, passing score, renewal, retake policy, score validity · verified Oct 2026