Test Prep ACT Test Exam Dumps & Practice Test Questions

Question 1:

The skyline of St. Louis, Missouri, doesn’t have many standout features — except for one notable landmark: the Gateway Arch along the Mississippi River.

Choose the best punctuation to replace the underlined section to improve clarity and match formal written English.

A. NO CHANGE
B. exception: the
C. exception; the
D. exception. The

Answer: D

Explanation:
The sentence as written uses an em dash to set off the phrase “except for one notable landmark: the Gateway Arch…”, which is grammatically acceptable in informal or stylistically expressive writing. However, the question specifies a need for clarity and formality, which is best achieved by restructuring the sentence into two independent clauses.

Option A — NO CHANGE retains the em dash and colon, which creates a slightly informal tone. While it’s grammatically permissible, it’s not the most formal or clear structure.

Option B — exception: the misuses the colon after a noun phrase that doesn’t directly lead into a list or explanation in a formally correct way. It’s less fluid and interrupts the rhythm of the sentence.

Option C — exception; the incorrectly uses a semicolon. A semicolon should separate two independent clauses, but “the Gateway Arch along the Mississippi River” is not a full independent clause.

Option D — exception. The is the best revision. It turns the sentence into two clear, complete, and formal clauses:
“The skyline of St. Louis, Missouri, doesn’t have many standout features. The one notable landmark is the Gateway Arch along the Mississippi River.”
Though the sentence remains similar in content, the period and capitalized “The” improve clarity, structure, and formal tone.

Thus, D is the most appropriate choice for formal written English.

Question 2:

The Gateway Arch is part of the Jefferson National Expansion Memorial and was constructed to commemorate the city’s role in the westward movement.

Which revision of the underlined phrase a really cool monument... most appropriately matches the tone and formality of the passage?

A. NO CHANGE
B. a structure that inspires amazement
C. an amazing structure
D. OMIT the phrase

Answer: B

Explanation:
The phrase “a really cool monument…” is too informal and vague for a passage written in a formal, descriptive tone. The context involves historical relevance and architectural significance, and therefore demands language that reflects respect, precision, and sophistication.

Let’s examine the options:

Option A — NO CHANGE uses casual language (“really cool”) that may be fine in speech or informal writing, but it’s inappropriate in a formal piece discussing historical landmarks. It lacks specificity and fails to convey the monument’s significance.

Option B — a structure that inspires amazement is the most appropriate revision. It maintains a formal tone, and the phrase clearly conveys emotional and visual impact in a dignified manner. This matches the tone of the sentence, which references the memorial and historical importance of the Gateway Arch.

Option C — an amazing structure improves upon “really cool” by removing slang, but the word “amazing” is still relatively informal and overused in general writing. It lacks the descriptive strength and precision of Option B.

Option D — OMIT the phrase removes the description entirely. While this keeps the passage factual, it also eliminates an opportunity to add evaluative or expressive detail, which helps the reader appreciate the Arch’s significance.

Therefore, B is the best choice because it aligns with the tone and purpose of the passage while adding a formal, meaningful description of the Gateway Arch.

Question 3:

In 1947, a design contest was held for a new monument intended to represent America’s growth

Choose the version of the underlined phrase that best expresses the purpose of the monument using clear, grammatically appropriate language.

A. NO CHANGE
B. should celebrate
C. did celebrate
D. would have celebrated

Answer: A

Explanation:
The sentence currently uses the phrase “intended to represent America’s growth,” which clearly and accurately describes the purpose of the monument at the time the contest was held. The phrase is in the past passive voice, appropriately linking the contest (in 1947) with the forward-looking goal of designing a monument that symbolized national development.

Let’s examine the other options:

Option A — NO CHANGE is correct because “intended to represent” expresses intention or purpose without ambiguity. It uses a simple, formal construction that fits well in historical and academic contexts.

Option B — should celebrate is somewhat ambiguous and speculative. “Should” may imply an opinion or recommendation rather than a clearly defined intention, making it less precise.

Option C — did celebrate wrongly implies that the celebration already happened at the time of the contest. This changes the timeline and misrepresents the nature of the event — the design contest was for a future monument, not one already in existence.

Option D — would have celebrated introduces a hypothetical condition, which is not accurate here. This construction implies that the celebration did not occur, which doesn’t align with the historical reality — the contest was indeed held, and a monument was eventually built.

Therefore, the best and most grammatically appropriate choice is A — NO CHANGE, as it preserves the correct meaning and tone of the sentence.

Question 4:

Other American monuments include spires, statues, and certain types of buildings. The Gateway Arch was chosen because it was something entirely different.

A. NO CHANGE
B. imposing buildings
C. buildings that imposed
D. buildings that are imposed

Answer: B

Explanation:
The sentence aims to contrast the common architectural forms found in American monuments (such as spires and statues) with the distinctiveness of the Gateway Arch. The best descriptive phrase for the buildings being referred to is one that conveys a formal, dignified tone and describes the visual or emotional impact these structures have.

Let’s analyze each option:

Option A — NO CHANGE uses the vague and awkward phrase “certain types of buildings,” which lacks specificity and weakens the sentence. It doesn’t contribute much to the contrast being drawn with the Gateway Arch.

Option B — imposing buildings is the best choice. It offers a clear, descriptive adjective that conveys both visual stature and emotional presence. The word “imposing” is formal, appropriate for architectural descriptions, and aligns with the tone of the passage. It enhances the contrast with the Arch, suggesting that unlike other monuments with grand, traditional designs, the Arch offers a fresh and unconventional aesthetic.

Option C — buildings that imposed is grammatically correct but stylistically awkward and unnecessarily wordy. The phrase lacks the flow and precision of “imposing buildings.”

Option D — buildings that are imposed is incorrect. This construction misuses the passive form “are imposed,” which implies that something is forced upon the buildings, rather than describing their appearance or effect. It doesn’t make sense in context.

Thus, the best answer is B — imposing buildings, which offers the right level of specificity, tone, and grammatical correctness for the sentence.

Question 5:

Eero Saarinen, the architect responsible for the Gateway Arch’s design, later gained international fame.
Which word correctly replaces the underlined phrase to properly refer to a person in this context?

A. NO CHANGE
B. which
C. who
D. whom

Answer: C

Explanation:
This sentence contains a relative clause referring to Eero Saarinen, a person, which means it requires the correct relative pronoun that refers to people and fits the grammatical structure of the sentence.

Let’s evaluate each choice:

Option A — NO CHANGE: The underlined phrase refers to “the architect responsible…”, and if the current sentence uses an incorrect relative pronoun like “that”, this is grammatically inappropriate when referring to people in formal writing. While “that” is sometimes used informally to refer to people, it is not considered standard in more polished or academic contexts. So, NO CHANGE is incorrect.

Option B — which: This is used exclusively to refer to things or animals, not people. Using “which” to refer to a person like Eero Saarinen is grammatically incorrect.

Option C — who: This is the correct relative pronoun when referring to the subject of a clause and referring to a person. In the sentence, “the architect responsible…” is the subject of the clause. So, “who” correctly fits both in terms of grammar and meaning.

Option D — whom: This form is used when referring to the object of a clause, not the subject. Since Eero Saarinen is the subject (he “gained international fame”), “whom” would be grammatically incorrect here.

To sum up:

• “Who” is used for subjects (correct here).

• “Whom” is used for objects (not correct here).

• “Which” and “that” refer to objects or animals, not people (incorrect in formal usage).

Therefore, the best and grammatically appropriate answer is C — who.

Question 6

Which two of the following are key phases in a forensic investigation process? (Choose 2.)

A. Identification and preparation
B. Reporting and documentation
C. Reconstruction and analysis
D. Data collection and preservation
E. Public communication and media management

Answer: B, D

Explanation:
The forensic investigation process is methodical and follows a sequence of well-defined phases designed to ensure that digital evidence is handled in a way that maintains its integrity, authenticity, and admissibility in court. Two key phases in this process are data collection and preservation and reporting and documentation.

Let’s evaluate each option:

Option A — Identification and preparation: While initial identification and planning are important, this option blends two separate ideas. “Preparation” is often part of pre-investigation planning, but it's not generally classified as one of the formal forensic phases. The recognized NIST model and similar frameworks usually begin with identification, but not in this bundled form.

Option B — Reporting and documentation: This is one of the final and most crucial phases in a forensic investigation. Once analysis is complete, the forensic expert must document findings in detail and produce formal reports that may be presented in court. The accuracy and clarity of this documentation can make or break a legal case. It ensures that all actions taken during the investigation are transparent, repeatable, and defensible.

Option C — Reconstruction and analysis: Analysis is a core phase, but “reconstruction” is more specific and sometimes occurs within the analysis phase. While the act of piecing together events (reconstruction) is important, it is generally seen as a sub-process of forensic analysis rather than a standalone phase. So, this phrasing is not ideal as a listed phase.

Option D — Data collection and preservation: This is a core part of the forensic process. It involves acquiring digital evidence in a way that maintains its integrity. Preservation ensures that the data remains unchanged and verifiable, which is vital for admissibility. This phase is foundational—without proper collection and preservation, evidence can be challenged or dismissed in court.

Option E — Public communication and media management: This is not part of a forensic investigation process. It might be relevant for incident response or public relations, but not for technical forensic procedures. It does not contribute to the legal or analytical goals of a forensic process.

Therefore, the correct answers are B and D, as both represent formal, critical stages in any forensic investigation model.

Question 7

Which two of the following are common methods of data acquisition in digital forensics? (Choose 2.)

A. Live acquisition using forensic tools
B. Copying the data directly to the suspect’s machine
C. Imaging the entire storage device for later analysis
D. Mounting the device as read-only to avoid tampering
E. Deleting unnecessary data before imaging the system

Answer: A, C

Explanation:
Data acquisition in digital forensics refers to the process of obtaining information from digital devices in a way that preserves evidence integrity and prevents any alteration. The two most widely recognized and forensically sound data acquisition methods are live acquisition using forensic tools and full disk imaging.

Let’s examine each option:

Option A — Live acquisition using forensic tools: This is a valid and often necessary method, particularly in situations where a device is running and data is volatile (e.g., RAM contents, network activity, encryption keys). Forensic tools like FTK Imager or Belkasoft RAM Capture are used during live acquisitions to preserve critical data before a shutdown, which might otherwise erase or encrypt it.

Option B — Copying the data directly to the suspect’s machine: This method is highly inappropriate and violates core forensic principles. Writing or storing forensic data on the suspect’s device risks evidence tampering and data corruption, rendering the acquisition unreliable or inadmissible in court.

Option C — Imaging the entire storage device for later analysis: This is a standard forensic practice. A bit-for-bit copy (also known as a forensic image) is created, which includes active files, deleted data, and slack space. Tools like EnCase or dd are used to ensure exact replicas are made without altering the original.

Option D — Mounting the device as read-only to avoid tampering: While this is a best practice when accessing forensic images, it’s more of a safeguard during analysis, not a method of data acquisition itself. It is used after the data has been acquired to ensure no changes are made to the evidence.

Option E — Deleting unnecessary data before imaging the system: This would violate forensic protocol. One of the most critical rules in forensics is never to alter the original evidence, which includes refraining from deleting any data. Even data that seems irrelevant could hold significance during later analysis.

Thus, the correct answers are A and C, as both represent valid and common methods of acquiring digital evidence in a forensically sound manner.

Question 8

Which two of the following techniques are used to maintain the integrity of evidence during the forensic process? (Choose 2.)

A. Creating hash values to ensure data consistency
B. Using encrypted containers to store digital evidence
C. Editing files to make them easier to analyze
D. Documenting the chain of custody for each piece of evidence
E. Overwriting old files on the evidence storage device

Answer: A, D

Explanation:
Maintaining the integrity of evidence is one of the most critical responsibilities during any digital forensic investigation. Ensuring that digital evidence remains unaltered, verifiable, and secure is essential to ensure it can be used in legal proceedings. There are well-established techniques for preserving digital evidence integrity, two of the most fundamental being the generation of hash values and documenting the chain of custody.

Option A, which involves creating hash values to ensure data consistency, is a standard practice in forensic analysis. A hash function generates a fixed-length alphanumeric string (the hash value) based on the contents of a file or piece of data. Common hashing algorithms used include MD5, SHA-1, and SHA-256. If the content of the data is altered even slightly, the hash value changes. Therefore, by generating a hash value at the time the evidence is first collected and comparing it to hash values at later stages, investigators can confirm that the evidence has not been tampered with. This process ensures data integrity and is considered a cornerstone of evidence verification in digital forensics.

Option D, documenting the chain of custody for each piece of evidence, is another fundamental technique. The chain of custody is a detailed, chronological record that shows the collection, custody, control, transfer, analysis, and disposition of evidence. It includes details about who collected the evidence, when and where it was collected, who accessed it, and under what circumstances. This documentation is critical in legal contexts, as it provides transparency and accountability, demonstrating that the evidence has been handled properly and has not been compromised. Without a clear chain of custody, the admissibility of digital evidence can be challenged in court.

In contrast, option B, using encrypted containers, while useful for security, does not directly relate to maintaining integrity in the forensic sense. It is more about protecting confidentiality rather than validating that the data hasn’t been altered.

Option C, editing files, is counterproductive in forensic investigations. Any modification of evidence—even for convenience—can compromise the validity of that evidence.

Option E, overwriting old files, is destructive and directly undermines evidence preservation. Once overwritten, original data cannot be retrieved, making this approach entirely unsuitable in forensic settings.

Thus, the two correct techniques for maintaining evidence integrity are A and D.

Question 9

Which two of the following file systems are commonly analyzed during digital forensic investigations? (Choose 2.)

A. NTFS
B. FAT32
C. EXT3/EXT4
D. HFS+
E. VMware Virtual Disk File (VMDK)

Answer: A, B

Explanation:
Digital forensic investigations often involve examining the file systems used on suspect devices to recover deleted files, extract metadata, and identify unauthorized activity. Among the most common file systems encountered are those used by mainstream operating systems, especially Microsoft Windows, due to its widespread use in both corporate and personal computing environments.

Option A, NTFS (New Technology File System), is the default file system for most modern Windows operating systems. It supports file-level security, journaling, disk quotas, and large file sizes, all of which offer valuable forensic artifacts. NTFS stores a wealth of metadata, such as file creation, access, modification times, as well as information about permissions and ownership. It also includes a Master File Table (MFT), which provides a detailed record of all files on the volume—essential during forensic recovery efforts. Due to its robustness and prevalence, NTFS is one of the most frequently analyzed file systems in forensics.

Option B, FAT32 (File Allocation Table 32), although older, is still used in many portable storage devices like USB drives and memory cards. Forensics professionals often encounter FAT32 when analyzing external storage or older operating systems. While FAT32 lacks many of the advanced features of NTFS (like security descriptors and journaling), it is simpler to parse and can still provide valuable insights. It is particularly useful in cases involving removable media, where FAT32 remains a common format due to its broad compatibility.

Option C, EXT3/EXT4, are Linux-based file systems and may also be analyzed in forensics, especially when dealing with servers or suspect machines running Linux. While important in certain contexts, they are not as commonly encountered in typical investigations compared to NTFS and FAT32.

Option D, HFS+, is the file system used by macOS prior to the introduction of APFS (Apple File System). Although relevant in Mac-related investigations, it is less common than NTFS or FAT32 in general digital forensic work due to the lower market share of macOS devices.

Option E, VMware VMDK files, are not file systems but rather disk image formats used in virtual machines. While forensic experts may extract and analyze file systems contained within VMDKs, the VMDK itself is not a file system—it’s a container.

Therefore, the most commonly analyzed file systems in general forensic practice are A and B.

Question 10

Which two of the following tools can be used for file carving in digital forensics? (Choose 2.)

A. EnCase
B. Autopsy
C. NetFlow
D. FTK Imager
E. Wireshark

Answer: A, B

Explanation:
In digital forensics, file carving is the process of recovering files without relying on file system metadata. This technique is essential when file systems are damaged, corrupted, or missing entirely—often in cases of deliberate tampering, data corruption, or deleted files. Forensic tools capable of performing file carving are crucial for investigators seeking to extract content based on known data signatures, even when directory information is absent.

Option A, EnCase, is a widely-used forensic software suite developed by OpenText (formerly Guidance Software). It offers a comprehensive range of forensic capabilities, including file system analysis, keyword searching, hash comparison, timeline creation, and crucially, file carving. EnCase uses file signatures and headers/footers to locate and recover deleted or fragmented files. Its graphical interface allows forensic analysts to carve specific file types from unallocated space or disk images. Due to its reliability and robust feature set, EnCase is one of the most trusted commercial solutions in professional digital forensics.

Option B, Autopsy, is a free, open-source digital forensics platform based on The Sleuth Kit (TSK). Autopsy includes powerful modules for file recovery, keyword search, timeline analysis, and file carving. Through integration with tools like PhotoRec and Scalpel, Autopsy can extract files based on known file headers, even if directory structures are lost. This capability makes Autopsy especially valuable in cases where disk images must be mined for hidden or deleted content. Being open source, it is also widely used in academic and government forensic labs.

Option C, NetFlow, is a network protocol developed by Cisco for collecting IP traffic information. It is used to monitor network performance and analyze traffic patterns, not for disk or file recovery. As such, it has no relevance in the context of file carving.

Option D, FTK Imager, is a tool designed primarily for creating forensic images and previewing disk contents. While it allows analysts to view and extract files, it lacks advanced file carving capabilities. Its strength lies in imaging and data acquisition, not in the recovery of data without file system references.

Option E, Wireshark, is a packet analyzer used for capturing and analyzing network traffic. It is instrumental in network forensics, not digital forensics focused on data recovery from storage media. It does not possess file carving features and is entirely unrelated to disk analysis.

In summary, both EnCase and Autopsy are legitimate and powerful tools for file carving in digital forensics. EnCase provides a professional-grade, commercial solution used in law enforcement and corporate investigations, while Autopsy offers a free, community-supported alternative that integrates well with other open-source forensic utilities. Therefore, the correct choices for file carving tools are A and B.