WGU COURSE C840 - DIGITAL
FORENSICS IN CYBERSECURITY
( UPDATE 2026/ 2027) QUESTIONS
AND ANSWERS WITH VERIFIED
SOLUTIONS 100% CORRECT
What is meant by slurred image?
A
memory allocated based on the last-in, first-out (LIFO) principle
B
the act of ensuring the data that is extracted is consistent
C
the result of acquiring a file as it is being updated
D
a brief hardware test the BIOS performs upon boot-up - CORRECT ANSWES -- C
A port is a number that identifies a channel in which communication can occur. There
are certain ports a forensic analyst should know on sight. This port uses SSH (Secure
Shell) to remotely and securely log on to a system.
A
Port 43
B
Port 25
C
Port 23
D
Port 22 - CORRECT ANSWES -- D
Those methods where the same key is used to encrypt and decrypt the plaintext is the
definition of:
A
stream cipher
B
Caesar cipher
C
steganography
,D
symmetric cryptography - CORRECT ANSWES -- D
What name is given to the art and science of writing hidden messages?
A
encryption
B
logical analysis
C
steganography
D
volatile data - CORRECT ANSWES -- C
Guidance Software offers a number of products, including Enterprise, eDiscovery,
Forensic, and Portable. _________ Enterprise allows the deepest level of visibility into
laptops, desktops, file servers, and e-mail servers. Use it to investigate human
resources matters or to quickly determine the root cause of suspicious network activity.
A
The Sleuth Kit
B
X-Ways Software Technology AG
C
Digital Intelligence
D
EnCase - CORRECT ANSWES -- D
Which Linux shell command is used to delete or remove a file?
A
mv
B
rmdir
C
rm
D
ps - CORRECT ANSWES -- C
The __________ cipher is the simplest single-alphabet substitution cipher. It is really
just a permutation of the Caesar cipher. All characters are rotated 13 characters through
the alphabet.
A
Vigenère
B
,ROT13
C
Atbash
D
Scytale - CORRECT ANSWES -- B
Computer forensics begins with a thorough understanding of what?
A
documentary evidence
B
computer hardware
C
expert testimony
D
law enforcement - CORRECT ANSWES -- B
Which starting-point forensic certification covers the general principles and techniques
of forensics, but not specific tools such as EnCase or FTK?
A
High Tech Crime Network Certifications
B
EC Council Certified Hacking Forensic Investigator
C
Global Information Assurance Certification Certifications
D
(ISC)2 CISSP certification - CORRECT ANSWES -- B
The __________ is a set of radio transceiver equipment that communicates with cellular
devices.
A
global system for mobile (GSM) communications
B
mobile switching center (MSC)
C
base station system (BSS)
D
base transceiver station (BTS) - CORRECT ANSWES -- C
This forensic certification is open to both the public and private sectors and is specific to
the use and mastery of FTK. Requirements for taking the exam include completing the
boot camp and Windows forensic courses.
A
, (ISC)2 CISSP certification
B
AccessData Certified Examiner
C
EC Council Certified Hacking Forensic Investigator
D
High Tech Crime Network Certifications - CORRECT ANSWES -- B
Because Mac OS X is based on FreeBSD, you can use shell commands to extract
information. The __________ command lists the current device files that are in use.
A
system_profiler SPHardwareDataType
B
ls /dev/disk?
C
/hdiutil partition /dev/disk0
D
system_profiler SPSoftwareDataType - CORRECT ANSWES -- B
Which of the following is the definition of steganalysis?
A
the determination of whether a file or communication hides other information
B
the instructions stored on a chip for booting up the computer
C
analysis involving using the native operating system, on the evidence disk or a forensic
duplicate, to peruse the data
D
data that an operating system creates and overwrites without the computer user taking
a direct action to save this data - CORRECT ANSWES -- A
What term is used to describe one of the five sections of the Windows Registry?
A
stack (S)
B
registry key
C
registry log
D
hive - CORRECT ANSWES -- D
FORENSICS IN CYBERSECURITY
( UPDATE 2026/ 2027) QUESTIONS
AND ANSWERS WITH VERIFIED
SOLUTIONS 100% CORRECT
What is meant by slurred image?
A
memory allocated based on the last-in, first-out (LIFO) principle
B
the act of ensuring the data that is extracted is consistent
C
the result of acquiring a file as it is being updated
D
a brief hardware test the BIOS performs upon boot-up - CORRECT ANSWES -- C
A port is a number that identifies a channel in which communication can occur. There
are certain ports a forensic analyst should know on sight. This port uses SSH (Secure
Shell) to remotely and securely log on to a system.
A
Port 43
B
Port 25
C
Port 23
D
Port 22 - CORRECT ANSWES -- D
Those methods where the same key is used to encrypt and decrypt the plaintext is the
definition of:
A
stream cipher
B
Caesar cipher
C
steganography
,D
symmetric cryptography - CORRECT ANSWES -- D
What name is given to the art and science of writing hidden messages?
A
encryption
B
logical analysis
C
steganography
D
volatile data - CORRECT ANSWES -- C
Guidance Software offers a number of products, including Enterprise, eDiscovery,
Forensic, and Portable. _________ Enterprise allows the deepest level of visibility into
laptops, desktops, file servers, and e-mail servers. Use it to investigate human
resources matters or to quickly determine the root cause of suspicious network activity.
A
The Sleuth Kit
B
X-Ways Software Technology AG
C
Digital Intelligence
D
EnCase - CORRECT ANSWES -- D
Which Linux shell command is used to delete or remove a file?
A
mv
B
rmdir
C
rm
D
ps - CORRECT ANSWES -- C
The __________ cipher is the simplest single-alphabet substitution cipher. It is really
just a permutation of the Caesar cipher. All characters are rotated 13 characters through
the alphabet.
A
Vigenère
B
,ROT13
C
Atbash
D
Scytale - CORRECT ANSWES -- B
Computer forensics begins with a thorough understanding of what?
A
documentary evidence
B
computer hardware
C
expert testimony
D
law enforcement - CORRECT ANSWES -- B
Which starting-point forensic certification covers the general principles and techniques
of forensics, but not specific tools such as EnCase or FTK?
A
High Tech Crime Network Certifications
B
EC Council Certified Hacking Forensic Investigator
C
Global Information Assurance Certification Certifications
D
(ISC)2 CISSP certification - CORRECT ANSWES -- B
The __________ is a set of radio transceiver equipment that communicates with cellular
devices.
A
global system for mobile (GSM) communications
B
mobile switching center (MSC)
C
base station system (BSS)
D
base transceiver station (BTS) - CORRECT ANSWES -- C
This forensic certification is open to both the public and private sectors and is specific to
the use and mastery of FTK. Requirements for taking the exam include completing the
boot camp and Windows forensic courses.
A
, (ISC)2 CISSP certification
B
AccessData Certified Examiner
C
EC Council Certified Hacking Forensic Investigator
D
High Tech Crime Network Certifications - CORRECT ANSWES -- B
Because Mac OS X is based on FreeBSD, you can use shell commands to extract
information. The __________ command lists the current device files that are in use.
A
system_profiler SPHardwareDataType
B
ls /dev/disk?
C
/hdiutil partition /dev/disk0
D
system_profiler SPSoftwareDataType - CORRECT ANSWES -- B
Which of the following is the definition of steganalysis?
A
the determination of whether a file or communication hides other information
B
the instructions stored on a chip for booting up the computer
C
analysis involving using the native operating system, on the evidence disk or a forensic
duplicate, to peruse the data
D
data that an operating system creates and overwrites without the computer user taking
a direct action to save this data - CORRECT ANSWES -- A
What term is used to describe one of the five sections of the Windows Registry?
A
stack (S)
B
registry key
C
registry log
D
hive - CORRECT ANSWES -- D
