IISFA Exam II0-001 Topic 3 Question 85 Discussion

Actual exam question for IISFA's II0-001 exam

Question #: 85
Topic #: 3

[All II0-001 Questions]

The MS Windows swap file is useful to an investigator because

AIt allows forensic utilities to operate more efficiently

BIt allows forensic utilities to have a work area for large memory pages

CIt allows forensic utilities to review what was in memory at the time of an abnormal shutdown

DIt allows forensic utilities to operate in a virtual mode

Show Suggested Answer

Suggested Answer: C

by Nancey at Apr 23, 2024, 01:57 AM

Limited Time Offer

25%

Off

Get Premium II0-001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lisha

22 days ago

Forensic utilities running more efficiently? That's nice, but I want to know what happened in memory. Option C is the one!

upvoted 0 times

Theodora

16 hours ago

I agree, knowing what was in memory can provide valuable information for an investigation.

upvoted 0 times

...

Lacresha

9 days ago

Option C is definitely the best choice. It allows us to review what was in memory at the time of an abnormal shutdown.

upvoted 0 times

...

Lucina

27 days ago

Haha, a 'work area for large memory pages'? That sounds like something out of a sci-fi movie. I'll take option C, the good old memory review.

upvoted 0 times

Art

5 days ago

User 1: I think option A is the best choice, it helps forensic utilities operate more efficiently.

upvoted 0 times

...

Patria

1 months ago

Virtual mode? That's interesting, but I think the ability to see what was in memory is the key benefit here. Option C is my pick.

upvoted 0 times

Tammara

17 hours ago

I think option C is the most important because it can help investigators understand the state of the system before the shutdown.

upvoted 0 times

...

Danica

16 days ago

I agree, being able to review what was in memory at the time of an abnormal shutdown can provide valuable information.

upvoted 0 times

...

Salome

1 months ago

I guess the swap file helps forensic tools manage their memory usage, but option C seems the most relevant to the question.

upvoted 0 times

Mica

3 days ago

I think option C is correct, it allows forensic utilities to review what was in memory at the time of an abnormal shutdown.

upvoted 0 times

...

Annmarie

2 months ago

I'm not sure, but I think D could also be a possibility.

upvoted 0 times

...

Marge

2 months ago

The swap file is definitely useful for reviewing memory contents during an abnormal shutdown. Option C is the way to go!

upvoted 0 times

Carmen

20 days ago

User 2

upvoted 0 times

...

Nickie

23 days ago

User 1

upvoted 0 times

...

Diane

2 months ago

I agree with Paris, C makes sense because it helps review what was in memory.

upvoted 0 times

...

Paris

2 months ago

I think the answer is C.

upvoted 0 times

...