1|Page
MCFE EXAM QUESTIONS WITH 100% CORRECT
ANSWERS !!
Workstations should have fast drives and high
input/output operations. - .....ANSWER ...✔✔ True
Remove duplicates removes them from the same or
multiple sources? - .....ANSWER ...✔✔ Same
Search speed increases as multi-tasking increases. -
.....ANSWER ...✔✔ False
Does Axiom automatically hash files larger than 500
MB? - .....ANSWER ...✔✔ It does NOT
All images and videos are AUTOMATICALLY hashed. -
.....ANSWER ...✔✔ True
You should always keep case files and evidence files
separate. - .....ANSWER ...✔✔ True
,2|Page
Evidence sources available can be dependent on the
Axiom license type. - .....ANSWER ...✔✔ True
Full = __________________ image - .....ANSWER
...✔✔ Physical
"All Files & Folders" = __________________________
- .....ANSWER ...✔✔ Logical File System
"All Files & Folders" captures deleted data. -
.....ANSWER ...✔✔ False
"Targeted" = ____________ image and
_________________ image - .....ANSWER ...✔✔
Logical & Triage
"Targeted" acquires areas most likely to contain
evidence. - .....ANSWER ...✔✔ True
"Quick" search searches MOST COMMON areas -
.....ANSWER ...✔✔ True
, 3|Page
"Full" search searches ALL areas. - .....ANSWER ...✔✔
True
"Sector-Level" search does NOT read raw data -
.....ANSWER ...✔✔ False
"Sector-Level" can't be used for chip-off - .....ANSWER
...✔✔ False
"Sector-Level" can be used for carving - .....ANSWER
...✔✔ True
Evidence Sources - File browser shows hidden files and
folders. - .....ANSWER ...✔✔ False
Evidence Sources is using Windows Explorer and not
Axiom. - .....ANSWER ...✔✔ True
Keywords are ____________ created by processing -
.....ANSWER ...✔✔ Artifacts
Processing only artifacts is the fastest option -
.....ANSWER ...✔✔ True
MCFE EXAM QUESTIONS WITH 100% CORRECT
ANSWERS !!
Workstations should have fast drives and high
input/output operations. - .....ANSWER ...✔✔ True
Remove duplicates removes them from the same or
multiple sources? - .....ANSWER ...✔✔ Same
Search speed increases as multi-tasking increases. -
.....ANSWER ...✔✔ False
Does Axiom automatically hash files larger than 500
MB? - .....ANSWER ...✔✔ It does NOT
All images and videos are AUTOMATICALLY hashed. -
.....ANSWER ...✔✔ True
You should always keep case files and evidence files
separate. - .....ANSWER ...✔✔ True
,2|Page
Evidence sources available can be dependent on the
Axiom license type. - .....ANSWER ...✔✔ True
Full = __________________ image - .....ANSWER
...✔✔ Physical
"All Files & Folders" = __________________________
- .....ANSWER ...✔✔ Logical File System
"All Files & Folders" captures deleted data. -
.....ANSWER ...✔✔ False
"Targeted" = ____________ image and
_________________ image - .....ANSWER ...✔✔
Logical & Triage
"Targeted" acquires areas most likely to contain
evidence. - .....ANSWER ...✔✔ True
"Quick" search searches MOST COMMON areas -
.....ANSWER ...✔✔ True
, 3|Page
"Full" search searches ALL areas. - .....ANSWER ...✔✔
True
"Sector-Level" search does NOT read raw data -
.....ANSWER ...✔✔ False
"Sector-Level" can't be used for chip-off - .....ANSWER
...✔✔ False
"Sector-Level" can be used for carving - .....ANSWER
...✔✔ True
Evidence Sources - File browser shows hidden files and
folders. - .....ANSWER ...✔✔ False
Evidence Sources is using Windows Explorer and not
Axiom. - .....ANSWER ...✔✔ True
Keywords are ____________ created by processing -
.....ANSWER ...✔✔ Artifacts
Processing only artifacts is the fastest option -
.....ANSWER ...✔✔ True
