GIAC
GCED · Question #1
GCED Question #1: Real Exam Question with Answer & Explanation
Sign in or unlock GCED to reveal the answer and full explanation for question #1. The question stem and answer options stay visible for context.
Question
At the start of an investigation on a Windows system, the lead handler executes the following commands after inserting a USB drive. What is the purpose of this command? C:\ >dir / s / a dhsra d:\ > a: \ IRCD.txt
Options
- ATo create a file on the USB drive that contains a listing of the C: drive
- BTo show hidden and archived files on the C: drive and copy them to the USB drive
- CTo copy a forensic image of the local C: drive onto the USB drive
- DTo compare a list of known good hashes on the USB drive to files on the local C: drive
Unlock GCED to see the answer
You've previewed enough free GCED questions. Unlock GCED for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.