Download PrepIQ Hexordia Data Structures Course Ultimate Exam and more Exams Technology in PDF only on Docsity!
Course Ultimate Exam
Question 1. Which hexadecimal value corresponds to the decimal number 255? A) 0xFF B) 0x0F C) 0x1F D) 0xF Answer: A Explanation: 255 in decimal equals 11111111 in binary, which is FF in hexadecimal. Question 2. Converting the binary string 101101 to decimal yields: A) 45 B) 53 C) 57 D) 59 Answer: B Explanation: 101101₂ = 1·2⁵ + 0·2⁴ + 1·2³ + 1·2² + 0·2¹ + 1·2⁰ = 32+0+8+4+0+ = 45? Wait compute: 32+8+4+1=45. Actually answer should be 45 (option A). Correcting: Answer: A. Explanation: Binary 101101 equals 45 in decimal. Question 3. In a little-endian 32-bit integer representation, the hex bytes 0x 0x56 0x34 0x12 correspond to the decimal value: A) 0x B) 0x C) 0x D) 0x Answer: A Explanation: Little-endian stores the least-significant byte first, so the byte order is reversed to 0x12 34 56 78, which equals 0x12345678. Question 4. Which of the following is the correct two’s-complement representation of – 42 in an 8-bit signed integer?
Course Ultimate Exam
A) 0xD B) 0x2A C) 0xDA D) 0x6D Answer: A Explanation: 42 = 00101010₂; invert → 11010101, add 1 → 11010110 = D6₁₆. Question 5. How many bits are in a “word” on a 32-bit architecture? A) 8 bits B) 16 bits C) 32 bits D) 64 bits Answer: C Explanation: A word matches the native register size; on a 32-bit CPU it is 32 bits. Question 6. A “nibble” consists of: A) 2 bits B) 4 bits C) 8 bits D) 16 bits Answer: B Explanation: A nibble is half a byte, i.e., 4 bits. Question 7. Which of the following hex sequences is the standard magic number for a Windows Portable Executable (PE) file? A) 4D 5A B) 50 45 00 00 C) 7F 45 4C 46 D) 25 50 44 46
Course Ultimate Exam
Question 11. The Mac OS “Absolute Time” epoch begins on: A) 1 Jan 1904 B) 1 Jan 1970 C) 1 Jan 2001 D) 1 Jan 1601 Answer: A Explanation: Classic Mac OS and early macOS use 1 Jan 1904 as epoch. Question 12. Apple Cocoa “Core Data” timestamps are stored as the number of seconds since which date? A) 1 Jan 1904 B) 1 Jan 1970 C) 1 Jan 2001 D) 1 Jan 1601 Answer: C Explanation: Cocoa’s reference date is 1 Jan 2001 00:00:00 GMT. Question 13. Google Chrome’s “WebKit” time is measured in microseconds since which epoch? A) 1 Jan 1970 B) 1 Jan 1601 C) 1 Jan 1904 D) 1 Jan 2001 Answer: B Explanation: WebKit time uses the same epoch as Windows FILETIME but counts microseconds. Question 14. In a ZIP file, the central directory header begins with which four-byte signature? A) 50 4B 03 04
Course Ultimate Exam
B) 50 4B 01 02
C) 50 4B 05 06
D) 50 4B 07 08
Answer: B Explanation: Central directory file header signature is 0x504B0102. Question 15. Which of the following is a valid “container” format that can embed multiple file types? A) BMP B) MP C) OLE Compound File D) TXT Answer: C Explanation: OLE (Object Linking and Embedding) Compound File acts as a filesystem within a file, holding many embedded streams. Question 16. In Protocol Buffers, what does the “wire type” value 0 indicate? A) 64-bit fixed B) Length-delimited C) Varint D) 32-bit fixed Answer: C Explanation: Wire type 0 is used for varint-encoded integers. Question 17. Which Protobuf field tag number is reserved and cannot be used for user-defined fields? A) 0 B) 1 C) 15 D) 31
Course Ultimate Exam
Question 21. In a binary plist, the trailer occupies how many bytes? A) 8 B) 12 C) 16 D) 32 Answer: C Explanation: The trailer is a fixed 32-byte structure containing offset-size, object-ref-size, etc. Question 22. Which SQLite file header magic string appears at the very beginning of every database file? A) “SQLite format 1” B) “SQLITE3DB” C) “DBFILE” D) “SQLITE-DB” Answer: A Explanation: The first 16 bytes of a SQLite file are “SQLite format 3\0”. Question 23. In SQLite B-tree pages, what does the “leaf” flag indicate? A) Page contains only interior nodes B) Page contains data records, not child pointers C) Page is part of the journal D) Page stores schema information only Answer: B Explanation: Leaf pages hold table or index entries without child page numbers. Question 24. Which SQLite journal mode writes changes to a separate “-wal” file? A) DELETE B) TRUNCATE
Course Ultimate Exam
C) PERSIST
D) WAL
Answer: D Explanation: Write-Ahead Logging creates a .wal file for uncommitted changes. Question 25. In a Windows Registry hive, the “hbin” structure begins with which signature? A) “regf” B) “hbin” C) “nk” D) “vk” Answer: B Explanation: Each hive bin starts with the ASCII string “hbin”. Question 26. The Registry key node (“nk”) stores the key name length in: A) 2 bytes, little-endian B) 4 bytes, big-endian C) 1 byte, ASCII D) 8 bytes, UTF- 16 Answer: A Explanation: nk structure uses a 2-byte little-endian length field for the name. Question 27. In an LNK (Shell Link) file, the LinkFlags field bit 0x indicates: A) The link target is a directory B) The link contains a description string C) The link has an ID list D) The link is a network share Answer: C
Course Ultimate Exam
Question 31. Jump List “AutomaticDestinations” files are stored with the extension: A) .lnk B) .jumplist C) .automaticDestinations-ms D) .destlist Answer: C Explanation: Automatic Destinations use the .automaticDestinations-ms extension. Question 32. Which of the following is the correct conversion of the hexadecimal byte 0xC3 to binary? A) 11000011 B) 11100011 C) 11001100 D) 10110011 Answer: A Explanation: 0xC3 = 12·16 + 3 = 195 → 11000011₂. Question 33. In a 64-bit little-endian system, the 8-byte value 0x01 00 00 00 00 00 00 00 represents the decimal number: A) 1 B) 256 C) 65536 D) 16777216 Answer: A Explanation: Little-endian stores the least-significant byte first; the value is 0x0000000000000001 = 1. Question 34. Which of the following correctly describes the difference between a “byte” and a “word” on a 64-bit Windows system?
Course Ultimate Exam
A) Byte = 8 bits, Word = 16 bits B) Byte = 8 bits, Word = 64 bits C) Byte = 16 bits, Word = 32 bits D) Byte = 8 bits, Word = 32 bits Answer: B Explanation: On Windows, a “word” historically means the natural register size; on a 64 - bit OS it is 64 bits. Question 35. The two’s-complement representation of the unsigned hex value 0xFF interpreted as a signed 8-bit integer equals: A) 255 B) – C) 0 D) – Answer: B Explanation: 0xFF as signed 8-bit two’s complement is – 1. Question 36. Which magic number identifies a PNG image file? A) 89 50 4E 47 B) FF D8 FF E C) 42 4D 38 00 D) 47 49 46 38 Answer: A Explanation: PNG files start with 0x89 50 4E 47 (“‰PNG”). Question 37. In a JPEG file, the Start of Image (SOI) marker is: A) FF D B) FF E C) 89 50
Course Ultimate Exam
Question 41. In a binary plist, the offset table entries are stored using how many bytes each? A) 1 byte B) 2 bytes C) 4 bytes D) Variable, defined in the trailer Answer: D Explanation: The trailer contains the offset-size field which tells how many bytes each offset entry uses. Question 42. Which SQLite page type is indicated by the header byte 0x0D? A) Index B-tree leaf B) Table B-tree interior C) Table B-tree leaf D) Free-list page Answer: C Explanation: 0x0D denotes a table B-tree leaf page. Question 43. In Windows Registry, the “vk” structure stores: A) Subkey name B) Value name and data C) Security descriptor D) Hive header information Answer: B Explanation: “vk” stands for Value Key, containing the value name, type, and data. Question 44. The “LinkInfo” block in an LNK file provides: A) The target’s network share path
Course Ultimate Exam
B) The icon location of the shortcut C) The working directory of the target D) The size of the target file Answer: A Explanation: LinkInfo contains the local and network volume information for the target. Question 45. Which of the following timestamps is stored as the number of seconds since 1 Jan 2001 00:00:00 UTC? A) Windows FILETIME B) macOS Core Data timestamp C) Unix epoch time D) Chrome WebKit time Answer: B Explanation: Cocoa Core Data uses the 2001 epoch. Question 46. In a ZIP file, the “End of Central Directory” record is identified by which signature? A) 50 4B 05 06 B) 50 4B 01 02 C) 50 4B 03 04 D) 50 4B 07 08 Answer: A Explanation: EOCD signature is 0x504B0506. Question 47. Which of the following statements about “big-endian” is true? A) Least-significant byte stored first B) Most-significant byte stored first C) Only used on ARM processors D) Only applicable to floating-point numbers
Course Ultimate Exam
Question 51. Which of the following file extensions typically indicates a Windows Registry hive file? A) .reg B) .dat C) .sys D) .hiv Answer: B Explanation: Hives are stored as binary “SYSTEM”, “SOFTWARE”, etc., commonly with a .dat extension. Question 52. The “RunCount” field in a Prefetch file is stored as a 4-byte little-endian integer. If the bytes are 0x0A 0x00 0x00 0x00, what is the RunCount? A) 10 B) 256 C) 65536 D) 1,048, Answer: A Explanation: Little-endian interprets the value as 0x0000000A = 10. Question 53. Which of these is a valid JSON number representation? A) 01 B) + C) 3.14e- D). Answer: C Explanation: JSON numbers may contain a fractional part and an exponent; leading zeros are not allowed (except for zero itself), plus sign is not permitted, and a number cannot start with a decimal point.
Course Ultimate Exam
Question 54. In an XML document, which construct defines a namespace prefix? A) xmlns:ns="uri" B) C) D) `` Answer: A Explanation: The xmlns:prefix="uri" attribute binds a prefix to a namespace URI. Question 55. Which of the following is the correct size of a Windows “DWORD” data type? A) 8 bits B) 16 bits C) 32 bits D) 64 bits Answer: C Explanation: DWORD stands for Double Word = 32 bits. Question 56. The magic number 0x1F 8B identifies which compression format? A) GZIP B) BZIP C) LZMA D) ZIP Answer: A Explanation: GZIP files start with 0x1F 0x8B. Question 57. In a Windows Registry hive, the “hbin” block size is stored in which field? A) First 4 bytes after the “hbin” signature B) Last 4 bytes of the block
Course Ultimate Exam
Explanation: XML comments use ``. Question 61. The “magic number” for a 7-Zip archive is: A) 37 7A BC AF 27 1C B) 50 4B 03 04 C) 42 5A 68 00 D) 4D 5A 90 00 Answer: A Explanation: 7-Zip files begin with the 6-byte sequence 0x37 0x7A 0xBC 0xAF 0x 0x1C. Question 62. Which of the following statements about two’s-complement arithmetic is correct? A) Adding two negative numbers can never overflow. B) The most-negative number has no positive counterpart. C) The sign bit is stored separately from the magnitude. D) Negative zero is represented as all zeros. Answer: B Explanation: In two’s complement, the most-negative value (e.g., – 2 ⁿ⁻¹) has no + counterpart because +2ⁿ⁻¹ exceeds the representable range. Question 63. In a binary plist, an object with marker 0x01 represents: A) Boolean false B) Boolean true C) Integer 0 D) Integer 1 Answer: D Explanation: Markers 0x00–0x0F encode small integers; 0x01 = integer value 1.
Course Ultimate Exam
Question 64. Which field in a Windows Prefetch file indicates the last time the executable was run? A) LastRunTime (FILETIME) B) Timestamp (Unix epoch) C) LastAccess (DOS date) D) No such field; Prefetch does not store a timestamp. Answer: A Explanation: Prefetch stores a FILETIME called “Last Run Time”. Question 65. The “magic” bytes 0x25 0x50 0x44 0x46 identify which file type? A) PDF B) PostScript C) PNG D) ZIP Answer: B Explanation: PostScript files start with “%PDF” for PDF, whereas “%!PS” is 0x 0x21 0x50 0x53. Actually 0x25 0x50 0x44 0x46 is “%PDF”. Wait correction: 0x 0x50 0x44 0x46 = “%PDF”. So answer should be A. Corrected: Answer: A. Explanation: PDF files begin with the ASCII string “%PDF”. Question 66. When converting a signed 32-bit integer – 1234 to hexadecimal two’s complement, the result is: A) 0xFFFFFB2E B) 0x000004D C) 0xFFFE4C2E D) 0x1234FFFF Answer: A Explanation: 1234 = 0x04D2; invert → 0xFFFFFB2D, add 1 → 0xFFFFFB2E.
