Windows OS Forensics Coursera Quiz Answers 2022 [💯Correct Answer]

Hello Peers, Today we are going to share all week’s assessment and quizzes answers of the Windows OS Forensics course launched by Coursera totally free of cost✅✅✅. This is a certification course for every interested student.

In case you didn’t find this course for free, then you can apply for financial ads to get this course for totally free.

Check out this article – “How to Apply for Financial Ads?”

About The Coursera

Coursera, India’s biggest learning platform launched millions of free courses for students daily. These courses are from various recognized universities, where industry experts and professors teach in a very well manner and in a more understandable way.

Here, you will find Windows OS Forensics Exam Answers in Bold Color which are given below.

These answers are updated recently and are 100% correct✅ answers of all week, assessment, and final exam answers of Windows OS Forensics from Coursera Free Certification Course.

Use “Ctrl+F” To Find Any Questions Answer. & For Mobile User, You Just Need To Click On Three dots In Your Browser & You Will Get A “Find” Option There. Use These Option to Get Any Random Questions Answer.

About Windows OS Forensics Course

The Windows OS Forensics course covers NTFS, Fat32, and ExFat as well as Windows file systems. You’ll learn about the data storage methods used by these systems, what occurs when a file is written to a disc, what happens when a file is deleted from a disc, and how to recover deleted files. Additionally, you’ll learn how to properly read the data in file system data structures, which will help you comprehend how these file systems function better. This information will help you correctly validate the data from various forensic instruments.

What you will discover

• The learner will gain knowledge of NTFS, Fat32, and ExFat as well as the Windows file systems.
• The way these systems store data, what occurs when a file is written to a disc, and what happens when a file is erased from a disc will all be explained to students.
• Students will get knowledge of file recovery.

Course Apply Link – Windows OS Forensics

Windows OS Forensics Quiz Answers

Week 1 Quiz Answers

Quiz 1: Windows OS Forensics Quiz

Q1. How many bits in a byte?

• 2 bits
• 4 bits
• 8 bits
• 10 bits

Q2. Binary is a base___ numbering system?

• Base 10
• Base 16
• Base 2
• Base 8

Q3. A bit has __ possible values?

• 256
• 2
• 16
• 1

Q4. A nybble is __ bytes long?

• 10
• 8
• 4
• 2

Q5. Hexadecimal is a base _ numbering system?

• 8
• 4
• 2
• 16

Q6. Data is stored on disk in _ format?

• Hexadecimal
• decimal
• Binary
• all zeros

Q7. A signed integer is a negative number if __ ?

• Always
• if the least significant bit is turned on
• if the most significant bit is turned off
• if the most significant bit is turned on

Q8. Little Endiann data is read __ ?

• only as hexadecimal
• from right to left
• from top to bottom
• from left to right

Q9. Intel processors tend to read data as _?

• little Endian
• never
• Decimal
• Big Endian

Q10. Low-level formatting is performed by ?

• The user
• only the system admin
• The drive manufactures
• disk management

Q11. Sectors are usually __ bytes in size ?

• 2048
• 512
• 10000
• 1024

Q12. _ are the smallest readable unit on a disk?

• Bytes
• Nibbles
• Sectors
• Clusters

Q13. Sector numbering starts at _ ?

• 3
• 1
• 8
• 0

Q14. Logical Block Addressing means that ?

• The sectors are not numbered sequentially
• Each sector is numbered sequentially starting at 1,2,3,4,…continuing until the end of the disk
• Each sector is numbered sequentially starting at 0,1,2,3,4,…continuing until the end of the disk.
• The sectors do not have numbers

Q15. Clusters are a group of __ ?

• Numbers
• Physical disks
• Volumes
• Sectors

Q16. The master partition table can have up to __ entries?

• 2
• 4
• 8
• 128

Q17. The master boot record is located at physical sector___ ?

• 1
• 3
• 0
• 2

Q18. A GPT formatted disk can have up to _ partitions?

• 1
• 128
• 1024
• 4

Q19. On an MBR formatted disk a partition entry is _ bytes long?

• 128
• 12
• 4
• 16

Q20. What is located in sector 0 of a disk formatted with GPT partition schema?

• a GPT header
• a volume boot record
• nothing
• a protective master boot record

Q21. In FAT 32 the root directory is located in ?

• The system area
• The data area
• Logical sector 0
• At the end of the volume

Q22. The most recent version of FAT is ?

• FAT 32
• FAT 12
• FAT 16
• exFAT

Q23. What does the FAT table track?

• Deleted files
• User names
• File types
• Cluster allocation

Q24. To find the number of sectors per cluster you would look at?

• The root directory
• The Volume Boot Record

Q25. How many FAT’s would you expect to find on a FAT32 volume?

• 3
• 2
• 1
• 4

Q26. A FAT32 Root directory entry is __ bytes long?

• 32
• 8
• 16
• 28

Q27. Every file and folder located in the root of a FAT volume will have ?

• a dos alias
• a volume label
• a long file name
• an entry in the root directory

Q28. FAT file time is recorded in ?

• the time zone of the local machine
• the FAT table
• UTC
• the volume boot record

Q29. The long file name attribute byte will always be ?

• 0x 00
• 0x E5
• 0x 0E
• 0x 0F

Q30. 0x E5 signifies what in the FAT root directory ?

• an allocated file
• nothing
• a deleted file
• the end of the root directory entries

Q31. In NTFS, everything is stored as a ?

• file
• in the system area
• volume
• extended logical partition

Q32. The Master file table contains ?

• only system files for recovery
• only resident data files
• only fragmented files
• a record of every file and folder on the volume including itself

Q33. The MFT Mirror contains ?

• A full backup of the MFT
• Is the same as the MFT
• More records than the MFT
• A partial backup of the MFT for recovery

Q34. The number of sectors per cluster in an NTFS volume can be found in ?

• The root Directory
• The Volume Boot Record
• The Master file Table
• The Master Boot Record

Q35. An MFT file record header starts with __ at offset 0?

• FILE
• Physical size of the MFT record
• Sequence Count
• Allocation status flags

Q36. The starting cluster of this data run (0x 21 55 8b 05) is __ ?

• 583
• 4096
• 1024
• 1419

Q37. When a file is deleted in NTFS the file record __ ?

• The record is zeroed out
• Nothing happens to the file record
• The allocation flag indicates an allocated file
• The sequence count is increased by one

Q38. What is not part of the exFAT system area ?

• Main Boot
• FAT
• Backup Boot
• Cluster Heap

Q39. The exFAT FAT table only tracks ?

• file allocation
• fragmented files
• all files
• the bitmap

Q40. The exFAT volume boot record is located at ?

• the root directory
• cluster 2
• physical sector 0 of the physical disk
• logical sector 0 of the volume

Q41. What does NOT happen when you delete a file in exFAT?

• the bitmap entries are set to 0
• FAT may or may not be zeroed out
• Directory entry set type flags set to not in use
• the data is deleted

Q42. The layout of the registry contains hives, Keys, sub-key, values, and __ ?

• hexadecimal
• data
• users
• applications

Q43. The file path to the Sam, Security, Software and System files within a forensic image file is ?

• Users/appdata/config
• Root/Windows/System32/config
• Root/WindowsNT/system/config
• Windows/users/system32/config

Q44. Every _ on a windows system has an NTuser.dat and a Usrclass.dat file ?

• Log File
• User
• System
• File

Q45. Every _ on a windows system has an NTuser.dat and a Usrclass.dat file ?

• Recent files accessed
• Active files and folders
• Program execution
• Each user such as login information, login password hashes, and group information

Q46. Time zone information can be found in which registry file ?

• Software
• System
• SAM
• NTUser.dat

Q47. Recent documents by file type can be found in which registry file?

• Software
• NTUser.dat
• System
• SAM

Conclusion

Hopefully, this article will be useful for you to find all the Week, final assessment, and Peer Graded Assessment Answers of Windows OS Forensics Quiz of Coursera and grab some premium knowledge with less effort. If this article really helped you in any way then make sure to share it with your friends on social media and let them also know about this amazing training. You can also check out our other course Answers. So, be with us guys we will share a lot more free courses and their exam/quiz solutions also, and follow our Techno-RJ Blog for more updates.