Free GASF Certification Overview Questions and Answers

Question 1

Based on the image below, which file system is being examined?

Accepted Answer

Chinese knock-off

Answer

Windows

Answer

Android

Answer

Blackberry

Question 2

What type of acquisition is being examined in the image below?

Accepted Answer

Android physical

Answer

iOS bypass lock

Answer

Blackberry logical

Answer

Windows Mobile file system

Question 3

Which of the following files contains details regarding the encryption state of an iTunes backup file?

Accepted Answer

Manifest.plist

Answer

Keychain-backup.plist

Answer

Manifest.mbdb

Answer

Status.plist

Question 4

In addition to the device passcode, what other essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

Accepted Answer

BlackBerry Link ID/password

Answer

BlackBerry Blend username/pin

Answer

BlackBerry Balance username/password

Answer

BBM pin

Question 5

The device pictured below is in Download Mode to attempt a physical acquisition. What can be ascertained by viewing the Android boot screen below?

Accepted Answer

The Original/Factory ROM is booting

Answer

The Android is not rooted

Answer

No ROM changes have ever occurred on this device

Answer

The Original ROM was at one time modified

Question 6

An analyst investigating a Nokia S30 Symbian device wants to know if an Adobe Flash file on the handset is compromised. Which file in the image will best target the Adobe Flash files?

Accepted Answer

FLASHLITE.sis

Answer

flashliteplugin.r03

Answer

saflash.r01

Answer

OnlinePrint.sis

Question 7

As part of your analysis of a legacy BlackBerry device, you examine the installed applications lists and it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on application that were accessed with the handset?

Accepted Answer

Event logs

Answer

BlackBerry NV Items

Answer

Content Store

Answer

BBThumbs.dat