WGU C702 CHFI and OA EXAM (2025) QUESTIONS AND
(DETAILED ANSWERS) WITH COMPLETE SOLUTIONS
Intruders attempting to gain remote access to a system try to find the other systems connected to the
network and visible to the compromised system. - answer- : True.
________ command is used to display the network configuration of the NICs on the system. - answer- :
ipconfig /all
Investigators can use Linux commands to gather necessary information from the system. Identify the
following shell command that is used to display the kernel ring buffer or information about device
drivers loaded into the kernel. - answer- : dmesg
What are the unique identification numbers assigned to Windows user account for granting user access
to particular resources? - answer- : Microsoft security ID.
In the Windows Event Log File internals, the following file is used to store the Databases related to the
system: - answer- : System.evtx
Thumbnails of images remain on computers even after files are deleted. - answer- : True
What is NOT one of the three tiers a log management infrastructure typically comprises? - answer- : Log
rotation
Which is NOT a log management system function? - answer- : Log generation.
What is NOT one of the three major concerns regarding log management? - answer- : Log viewing
,Which is a type of network-based attack? - answer- : Eavesdropping
Which attack does NOT directly lead to unauthorized access? - answer- : Denial of service
How can an attacker exploit a network? - answer- : Through wired or wireless connections.
What is the primary reason for forensic investigators to examine logs? - answer- : To gain an insight into
events that occurred in the affected devices/network.
Which is true about the transport layer in the TCP/IP model? - answer- : It is the backbone for data flow
between two devices in a network.
What is an ongoing process that returns results simultaneously so that the system or operators can
respond to attacks immediately? - answer- : Real time analysis
Which of the following is an internal network vulnerability? - answer- : bottleneck
Which attack is specific to wireless networks? - answer- : Jamming signal attack.
Where can congressional security standards and guidelines be found, along with an emphasis for federal
agencies to develop, document, and implement organization-wide programs for information security? -
answer- : FISMA
What requires companies that offer financial products or services to protect customer information
against security threats? - answer- : GLBA
Which of the following includes security standards for health information? - answer- : HIPAA
What is the act passed by the U.S. Congress to protect investors from the possibility of fraudulent
accounting activities by corporations? - answer- : SOX
, What is a proprietary information security standard for organizations that handle cardholder
information for major debit, credit, prepaid, e-purse, ATM, and POS cards? - answer- : PCI DSS
In what type of forensic examination do investigators perform an examination of logs to detect
something that has already occurred in a network/device and determine what it is? - answer- :
Postmortem
What are the most common network attacks launched against wireless networks? - answer- : AP MAC
spoofing
In Event Correlation Approaches, which approach is used to monitor the computers and computer users
behavior and provide an alert if something anomalous is found? - answer- : Role-based approach
The investigator uses which of the following commands to view the ARP table in Windows? - answer- :
arp -a
Which is NOT an indication of a web attack? - answer- : logs found to have no known anomalies.
Which is a threat to web applications? - answer- : Cookie poisoning.
What layer of web application architecture includes all the web appliances, such as smartphones and
PCs, where interaction with a web application deployed on a web server occurs? - answer- : Client layer
What layer of web application architecture contains components that parse the request (HTTP Request
Parser) coming in and forwards the response back? - answer- : Web server layer
What layer of web application architecture is responsible for the core functioning of the system and
includes logic and application, such as .NET, used by developers to build websites according to client
requirements? - answer- : Business layer
(DETAILED ANSWERS) WITH COMPLETE SOLUTIONS
Intruders attempting to gain remote access to a system try to find the other systems connected to the
network and visible to the compromised system. - answer- : True.
________ command is used to display the network configuration of the NICs on the system. - answer- :
ipconfig /all
Investigators can use Linux commands to gather necessary information from the system. Identify the
following shell command that is used to display the kernel ring buffer or information about device
drivers loaded into the kernel. - answer- : dmesg
What are the unique identification numbers assigned to Windows user account for granting user access
to particular resources? - answer- : Microsoft security ID.
In the Windows Event Log File internals, the following file is used to store the Databases related to the
system: - answer- : System.evtx
Thumbnails of images remain on computers even after files are deleted. - answer- : True
What is NOT one of the three tiers a log management infrastructure typically comprises? - answer- : Log
rotation
Which is NOT a log management system function? - answer- : Log generation.
What is NOT one of the three major concerns regarding log management? - answer- : Log viewing
,Which is a type of network-based attack? - answer- : Eavesdropping
Which attack does NOT directly lead to unauthorized access? - answer- : Denial of service
How can an attacker exploit a network? - answer- : Through wired or wireless connections.
What is the primary reason for forensic investigators to examine logs? - answer- : To gain an insight into
events that occurred in the affected devices/network.
Which is true about the transport layer in the TCP/IP model? - answer- : It is the backbone for data flow
between two devices in a network.
What is an ongoing process that returns results simultaneously so that the system or operators can
respond to attacks immediately? - answer- : Real time analysis
Which of the following is an internal network vulnerability? - answer- : bottleneck
Which attack is specific to wireless networks? - answer- : Jamming signal attack.
Where can congressional security standards and guidelines be found, along with an emphasis for federal
agencies to develop, document, and implement organization-wide programs for information security? -
answer- : FISMA
What requires companies that offer financial products or services to protect customer information
against security threats? - answer- : GLBA
Which of the following includes security standards for health information? - answer- : HIPAA
What is the act passed by the U.S. Congress to protect investors from the possibility of fraudulent
accounting activities by corporations? - answer- : SOX
, What is a proprietary information security standard for organizations that handle cardholder
information for major debit, credit, prepaid, e-purse, ATM, and POS cards? - answer- : PCI DSS
In what type of forensic examination do investigators perform an examination of logs to detect
something that has already occurred in a network/device and determine what it is? - answer- :
Postmortem
What are the most common network attacks launched against wireless networks? - answer- : AP MAC
spoofing
In Event Correlation Approaches, which approach is used to monitor the computers and computer users
behavior and provide an alert if something anomalous is found? - answer- : Role-based approach
The investigator uses which of the following commands to view the ARP table in Windows? - answer- :
arp -a
Which is NOT an indication of a web attack? - answer- : logs found to have no known anomalies.
Which is a threat to web applications? - answer- : Cookie poisoning.
What layer of web application architecture includes all the web appliances, such as smartphones and
PCs, where interaction with a web application deployed on a web server occurs? - answer- : Client layer
What layer of web application architecture contains components that parse the request (HTTP Request
Parser) coming in and forwards the response back? - answer- : Web server layer
What layer of web application architecture is responsible for the core functioning of the system and
includes logic and application, such as .NET, used by developers to build websites according to client
requirements? - answer- : Business layer
