GIAC Exam GCED Topic 8 Question 60 Discussion

Actual exam question for GIAC's GCED exam

Question #: 60
Topic #: 8

[All GCED Questions]

At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d: \ > a: \ IRCD.txt

ATo create a file on the USB drive that contains a listing of the C: drive

BTo show hidden and archived files on the C: drive and copy them to the USB drive

CTo copy a forensic image of the local C: drive onto the USB drive

DTo compare a list of known good hashes on the USB drive to files on the local C: drive

Show Suggested Answer

Suggested Answer: E

After selecting ''fix it!'' with Hijack This you can always restore deleted items, because Hijack This keeps a backup of them.

by Paola at Mar 03, 2025, 07:19 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Erick

1 days ago

I'm not sure, but I think it could also be to create a file on the USB drive that contains a listing of the C: drive.

upvoted 0 times

...

Alethea

2 days ago

I agree with Rory. It seems like the command is used to gather information from the C: drive onto the USB drive.

upvoted 0 times

...

Rory

4 days ago

I think the purpose is to show hidden and archived files on the C: drive and copy them to the USB drive.

upvoted 0 times

...