Free CCE Practice Questions

Question 1

A forensic export of notes.txt contains 86 bytes, and its SHA-256 matches the source file's unnamed $DATA stream. The NTFS record also contains a named $DATA stream, records, with a logical size of 45,056 bytes. The examiner needs to determine whether relevant content was omitted. What should be examined next?

Accepted Answer

Export notes.txt:records:$DATA and calculate its hash separately from the 86-byte unnamed stream.

Answer

Read the unnamed stream's cluster slack as the missing file content.

Answer

Repeat the ordinary notes.txt export with a second forensic tool.

Answer

Carve unallocated disk space for deleted copies before examining the allocated named stream.

Question 2

A Windows Security event 4624 has LogonType 9. Its New Logon account is LOCAL\analyst, while Network Account Name is backupsvc and Network Account Domain is CORP. An investigator labels this an incoming Remote Desktop session by CORP\backupsvc. The event instead describes:

Accepted Answer

A session retaining the local identity while using CORP\backupsvc for outbound network connections.

Answer

An incoming network logon by CORP\backupsvc to the local computer.

Answer

A service logon initiated by the Service Control Manager for CORP\backupsvc.

Answer

A cached Remote Desktop logon by CORP\backupsvc, authenticated without contacting a domain controller.

Question 3

A disk reports 2,000,000,000 addressable logical sectors, 512 bytes per logical sector, and 4,096 bytes per physical sector. A full raw acquisition contains 1,024,000,000,000 bytes with no reported read errors. During the byte-count check, how should the examiner classify this image length?

Accepted Answer

Consistent with the logical address space; content integrity still requires separate verification.

Answer

Too large: eight logical sectors share each physical sector, so only 128,000,000,000 image bytes are expected.

Answer

Too small: each reported sector must contribute 4,096 bytes, so 8,192,000,000,000 image bytes are required.

Answer

Short by 512 bytes: the reported sector count excludes the sector whose address is zero.

Question 4

An active exFAT file has DataLength=8,192 and ValidDataLength=5,000. Its directory-entry set and allocation are valid. Raw bytes mapped to file offset 6,000 contain readable text, but a logical file read returns zeros there. Which interpretation accounts for both observations?

Accepted Answer

The text lies beyond initialized file data; logical reads of that region must return zeros.

Answer

The text lies beyond the logical end of the file and is ordinary end-of-file cluster slack.

Answer

The text is current file content because DataLength makes every on-disk byte in that range valid.

Answer

The disagreement indicates a damaged acquisition that must be repeated before this file can be examined.

Question 5

A consistent acquisition contains a SQLite database and its complete write-ahead log (WAL). In one valid WAL generation, frames 1 through 15 pass their salt and checksum checks. Frame 12 is the last frame with a nonzero database-size field; frames 13 through 15 have zero in that field. To report the latest committed database state, the examiner should:

Accepted Answer

Use the main database with the latest applicable page versions through frame 12.

Answer

Use all 15 frames; their valid checksums make them committed changes.

Answer

Use the main database alone; only a checkpoint makes the logged changes part of a committed database.

Answer

Use frame 12 alone; a commit frame contains the transaction's complete set of changed pages.

Question 6

Two regular files in the live namespace of one APFS volume have different file identifiers but initially reference the same data extents. A later write to one file allocates a replacement extent, and the other file retains the original bytes. There is no intervening file replacement. What relationship fits this behavior?

Accepted Answer

Separate clone files using copy-on-write storage sharing.

Answer

Two hard links naming the same underlying file object.

Answer

A symbolic link and its target sharing one content stream.

Answer

Two names for one file within a read-only volume snapshot.

Question 7

A passcode-locked iPhone is undergoing an authorized USB extraction. The handset begins hissing, its case separates near the battery, and its temperature rises rapidly. The examiner believes this may be the only opportunity to obtain the data. What takes precedence over completing the extraction?

Accepted Answer

Stop use, cut external power if safe, and activate the laboratory's battery-emergency procedure.

Answer

Reduce the extraction to essential records and finish while monitoring the battery's condition.

Answer

Pause extraction but leave USB power connected so the current access state survives until technical support arrives.

Answer

Transfer the phone to an RF-shielded enclosure and resume acquisition there to protect it from remote commands.

Question 8

An endpoint records a file-close event at 14:03:20 UTC. A contemporaneous check establishes that its clock is 90 seconds fast, with an error bound of 10 seconds that applies to the event time. A server records an upload completion at 14:01:56 UTC with an error bound of 2 seconds. No clock adjustments occurred. How should these events be ordered?

Accepted Answer

The corrected file-close time is approximately 14:01:50 UTC, but the possible event times overlap.

Answer

The file closed at approximately 14:04:50 UTC, so it must have followed upload completion.

Answer

The file closed at approximately 14:01:50 UTC, so it must have preceded upload completion by six seconds.

Answer

The file closed at approximately 14:03:20 UTC, because UTC timestamps do not require clock-error correction.

Question 9

A persistence lead identifies HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run in Morgan's Windows session. The computer is now powered off, and the examiner has a verified disk image. Which acquired hive should be opened to inspect Morgan's value data at that path?

Accepted Answer

Morgan's NTUSER.DAT, storing per-user Registry settings.

Answer

Windows\System32\config\SOFTWARE, containing the machine-wide software configuration.

Answer

Morgan's AppData\Local\Microsoft\Windows\UsrClass.dat, containing per-user class registrations.

Answer

Windows\System32\config\SYSTEM, containing control sets and service configuration.

Question 10

On an NTFS 3.1 volume, a historical USN record for proposal.docx contains file reference 620:9: MFT record 620, sequence number 9. The current valid MFT record 620 has sequence number 10 and names holiday.jpg. The examiner is deciding whether to merge their histories. Which explanation of the sequence-number difference is consistent with normal NTFS operation?

Accepted Answer

Record 620 was reused; the two references identify different file incarnations.

Answer

A rename changed the sequence but kept the same underlying file identity.

Answer

A content edit created revision 10 of the same file record.

Answer

A move between directories changed the sequence because the parent reference changed.

Free CCE Practice Questions

Domain 1: Technology Management

Question 1

Domain 2: Service Delivery Management

Question 2

Domain 3: Product Development, Testing, Evaluation, and Modification

Question 3

Domain 4: Information Technology (IT) / Telecommunications / Cybersecurity

Question 4

Domain 5: Education of Others

Question 5

Question 6

Domain 6: Facilities Management

Question 7

Question 8

Domain 7: Risk Management / Safety

Question 9

Domain 8: General Management

Question 10

That's 10 of 1,030