Into which two categories can an imported hash set be assigned? (Choose two.)

The correct answer is A. alert B. ignore. When importing hash sets into digital forensics tools (such as EnCase or similar platforms), investigators must assign them to one of two functional categories: alert or ignore. An alert hash set flags any matching files for investigator review - typically used for known…

Artifact Analysis (e.g., Internet history, email, registry)

Question

Into which two categories can an imported hash set be assigned? (Choose two.)

Options

Aalert
Bignore
Ccontraband
Dsystem files

How the community answered

(60 responses)

A
93% (56)
C
3% (2)
D
3% (2)

Explanation

When importing hash sets into digital forensics tools (such as EnCase or similar platforms), investigators must assign them to one of two functional categories: alert or ignore. An alert hash set flags any matching files for investigator review - typically used for known malicious or contraband files. An ignore hash set tells the tool to skip matching files as known-good - commonly used for standard OS or application files to reduce noise.

Why C (contraband) and D (system files) are wrong: These describe the content or nature of the files within a hash set, not the operational category assigned to the set itself. A hash set containing contraband file hashes would be assigned the alert category; one containing system file hashes would be assigned the ignore category.

Memory tip: Think of it as a two-way gate - Alert = "stop and look", Ignore = "walk on by". Everything else (what the files actually are) is just the reason you chose one gate over the other.

Topics

#hash sets#file categorization#forensic filtering#known file identification

Community Discussion

No community discussion yet for this question.

Full A30-327 Practice