WGU MASTER'S COURSE C702 FORENSICS AND NETWORK
INTRUSION EXAM 300 ACTUAL QUESTIONS AND CORRECT
ANSWERS WITH RATIONALE LATEST UPDATE ALREADY
GRADED A+
This comprehensive exam validates expertise in digital forensics and network
intrusion investigation. It covers the complete forensic lifecycle, from evidence
acquisition and preservation to analysis and court presentation. Candidates
must demonstrate proficiency in file system forensics (NTFS, FAT32, Ext),
memory analysis, log examination, and network traffic inspection. The
curriculum addresses legal frameworks, chain of custody, and investigative
methodologies for both criminal and administrative cases. Students are tested
on operating system artifacts, malware analysis, intrusion detection, and
incident response procedures. The exam emphasizes practical application
through scenario-based questions and prepares students for the EC-Council
CHFI certification.
Question 1
What is the primary objective of computer forensics?
A. To prevent future cyber attacks
B. To collect, preserve, analyze, and present digital evidence
C. To develop new encryption algorithms
D. To monitor network traffic in real time
Answer: B. To collect, preserve, analyze, and present digital evidence
Rationale: The core purpose of computer forensics is to identify, preserve, analyze,
and present digital evidence in a manner that is legally admissible. While
preventing future attacks is a secondary benefit, the primary objective focuses on
evidence handling for legal proceedings .
Question 2
Which role is primarily responsible for securing the scene and preserving volatile
data in the CHFI framework?
A. Examiner
B. Expert Witness
C. First Responder
,D. Analyst
Answer: C. First Responder
Rationale: The First Responder is responsible for securing the scene, ensuring
safety, and capturing volatile data before it is lost. This is a critical initial step in
the investigation process .
Question 3
Which type of digital evidence is most likely to change or be lost if the system is
powered off?
A. Hard drive image
B. Browser cache files
C. RAM contents
D. System log files
Answer: C. RAM contents
Rationale: RAM is volatile memory; its contents disappear when power is lost,
unlike non-volatile storage such as hard drives. Therefore, RAM must be captured
first during evidence collection .
Question 4
What does the "Best Evidence Rule" require?
A. That the original document be produced unless it is unavailable
B. That all evidence be encrypted
C. That digital evidence is always admissible
D. That evidence is stored in a sealed container
Answer: A. That the original document be produced unless it is unavailable
Rationale: The Best Evidence Rule states that secondary evidence or a copy is
inadmissible when the original exists. However, courts may accept a duplicate if
the original is lost or destroyed and the duplicate is shown to be reliable .
Question 5
Which of the following is NOT an ACPO (Association of Chief Police Officers)
principle?
A. No action shall be taken which might alter data on a computer system
B. All actions taken must be documented
C. Evidence must be stored in a sealed container at all times
D. The person in charge must be competent and authorized
Answer: C. Evidence must be stored in a sealed container at all times
Rationale: ACPO principles emphasize preservation, documentation, and
competency but do not specifically require evidence to be stored in a sealed
,container at all times. That is a best practice for chain of custody, but not a formal
ACPO principle .
Question 6
During the first response, a forensic investigator encounters a powered-on laptop.
What is the proper order of acquisition?
A. Capture RAM, then acquire a forensic image of the hard drive
B. Shut down the laptop, then image the hard drive
C. Remove the battery before any acquisition
D. Immediately copy the swap file only
Answer: A. Capture RAM, then acquire a forensic image of the hard drive
Rationale: Volatile data (RAM) must be captured first as it is lost when power is
removed. After that, the storage media can be imaged without the risk of losing
volatile evidence .
Question 7
Which hashing algorithm is considered more collision-resistant for verifying
forensic images?
A. MD5
B. SHA-1
C. SHA-256
D. CRC32
Answer: C. SHA-256
Rationale: SHA-256 is more collision-resistant than MD5 and SHA-1, making it a
more secure choice for verifying the integrity of forensic images. It generates a
larger hash value, reducing the probability of two different files producing the
same hash .
Question 8
What is the proper order of volatility for collecting digital evidence, from most to
least volatile?
A. CPU Registers & Cache, RAM, Temporary File Systems, Disk
B. Disk, RAM, CPU Registers & Cache, Temporary File Systems
C. Temporary File Systems, RAM, CPU Registers & Cache, Disk
D. RAM, Disk, CPU Registers & Cache, Temporary File Systems
Answer: A. CPU Registers & Cache, RAM, Temporary File Systems, Disk
Rationale: The order of volatility dictates that the most volatile data, such as CPU
registers and cache, should be collected first, followed by RAM, then temporary
file systems, and finally persistent storage like disks .
, Question 9
A forensic examiner is analyzing a Windows Prefetch file. What information can
be reliably extracted?
A. User's login password
B. Executable name, path, and last run time
C. List of installed drivers
D. Encryption keys for BitLocker
Answer: B. Executable name, path, and last run time
Rationale: Prefetch files are used to speed up application loading and record the
executable name, its path, and timestamps of the last few times it was executed.
They are valuable for determining program usage .
Question 10
Which file system attribute is used by NTFS to indicate that a file has been deleted
but its data clusters are still allocated?
A. FILE_ATTRIBUTE_HIDDEN
B. $MFT entry marked as "deleted" with the "in use" flag cleared
C. $LogFile entry
D. $Bitmap entry showing free clusters
Answer: B. $MFT entry marked as "deleted" with the "in use" flag cleared
Rationale: In NTFS, when a file is deleted, its MFT (Master File Table) record
remains but the "in use" flag is cleared, allowing the data clusters to be recovered
until they are overwritten .
Question 11
When performing a logical acquisition of a Linux system, which of the following
is typically captured?
A. Entire raw disk image
B. Only selected files and directories
C. RAM dump
D. BIOS firmware
Answer: B. Only selected files and directories
Rationale: Logical acquisition copies specific files and directories of interest,
rather than an entire disk image. This is faster and focuses on relevant data but may
miss deleted or hidden files .
Question 12
Which of the following statements about SSDs and forensic imaging is true?
A. SSDs never use wear-leveling, so data is stored sequentially
INTRUSION EXAM 300 ACTUAL QUESTIONS AND CORRECT
ANSWERS WITH RATIONALE LATEST UPDATE ALREADY
GRADED A+
This comprehensive exam validates expertise in digital forensics and network
intrusion investigation. It covers the complete forensic lifecycle, from evidence
acquisition and preservation to analysis and court presentation. Candidates
must demonstrate proficiency in file system forensics (NTFS, FAT32, Ext),
memory analysis, log examination, and network traffic inspection. The
curriculum addresses legal frameworks, chain of custody, and investigative
methodologies for both criminal and administrative cases. Students are tested
on operating system artifacts, malware analysis, intrusion detection, and
incident response procedures. The exam emphasizes practical application
through scenario-based questions and prepares students for the EC-Council
CHFI certification.
Question 1
What is the primary objective of computer forensics?
A. To prevent future cyber attacks
B. To collect, preserve, analyze, and present digital evidence
C. To develop new encryption algorithms
D. To monitor network traffic in real time
Answer: B. To collect, preserve, analyze, and present digital evidence
Rationale: The core purpose of computer forensics is to identify, preserve, analyze,
and present digital evidence in a manner that is legally admissible. While
preventing future attacks is a secondary benefit, the primary objective focuses on
evidence handling for legal proceedings .
Question 2
Which role is primarily responsible for securing the scene and preserving volatile
data in the CHFI framework?
A. Examiner
B. Expert Witness
C. First Responder
,D. Analyst
Answer: C. First Responder
Rationale: The First Responder is responsible for securing the scene, ensuring
safety, and capturing volatile data before it is lost. This is a critical initial step in
the investigation process .
Question 3
Which type of digital evidence is most likely to change or be lost if the system is
powered off?
A. Hard drive image
B. Browser cache files
C. RAM contents
D. System log files
Answer: C. RAM contents
Rationale: RAM is volatile memory; its contents disappear when power is lost,
unlike non-volatile storage such as hard drives. Therefore, RAM must be captured
first during evidence collection .
Question 4
What does the "Best Evidence Rule" require?
A. That the original document be produced unless it is unavailable
B. That all evidence be encrypted
C. That digital evidence is always admissible
D. That evidence is stored in a sealed container
Answer: A. That the original document be produced unless it is unavailable
Rationale: The Best Evidence Rule states that secondary evidence or a copy is
inadmissible when the original exists. However, courts may accept a duplicate if
the original is lost or destroyed and the duplicate is shown to be reliable .
Question 5
Which of the following is NOT an ACPO (Association of Chief Police Officers)
principle?
A. No action shall be taken which might alter data on a computer system
B. All actions taken must be documented
C. Evidence must be stored in a sealed container at all times
D. The person in charge must be competent and authorized
Answer: C. Evidence must be stored in a sealed container at all times
Rationale: ACPO principles emphasize preservation, documentation, and
competency but do not specifically require evidence to be stored in a sealed
,container at all times. That is a best practice for chain of custody, but not a formal
ACPO principle .
Question 6
During the first response, a forensic investigator encounters a powered-on laptop.
What is the proper order of acquisition?
A. Capture RAM, then acquire a forensic image of the hard drive
B. Shut down the laptop, then image the hard drive
C. Remove the battery before any acquisition
D. Immediately copy the swap file only
Answer: A. Capture RAM, then acquire a forensic image of the hard drive
Rationale: Volatile data (RAM) must be captured first as it is lost when power is
removed. After that, the storage media can be imaged without the risk of losing
volatile evidence .
Question 7
Which hashing algorithm is considered more collision-resistant for verifying
forensic images?
A. MD5
B. SHA-1
C. SHA-256
D. CRC32
Answer: C. SHA-256
Rationale: SHA-256 is more collision-resistant than MD5 and SHA-1, making it a
more secure choice for verifying the integrity of forensic images. It generates a
larger hash value, reducing the probability of two different files producing the
same hash .
Question 8
What is the proper order of volatility for collecting digital evidence, from most to
least volatile?
A. CPU Registers & Cache, RAM, Temporary File Systems, Disk
B. Disk, RAM, CPU Registers & Cache, Temporary File Systems
C. Temporary File Systems, RAM, CPU Registers & Cache, Disk
D. RAM, Disk, CPU Registers & Cache, Temporary File Systems
Answer: A. CPU Registers & Cache, RAM, Temporary File Systems, Disk
Rationale: The order of volatility dictates that the most volatile data, such as CPU
registers and cache, should be collected first, followed by RAM, then temporary
file systems, and finally persistent storage like disks .
, Question 9
A forensic examiner is analyzing a Windows Prefetch file. What information can
be reliably extracted?
A. User's login password
B. Executable name, path, and last run time
C. List of installed drivers
D. Encryption keys for BitLocker
Answer: B. Executable name, path, and last run time
Rationale: Prefetch files are used to speed up application loading and record the
executable name, its path, and timestamps of the last few times it was executed.
They are valuable for determining program usage .
Question 10
Which file system attribute is used by NTFS to indicate that a file has been deleted
but its data clusters are still allocated?
A. FILE_ATTRIBUTE_HIDDEN
B. $MFT entry marked as "deleted" with the "in use" flag cleared
C. $LogFile entry
D. $Bitmap entry showing free clusters
Answer: B. $MFT entry marked as "deleted" with the "in use" flag cleared
Rationale: In NTFS, when a file is deleted, its MFT (Master File Table) record
remains but the "in use" flag is cleared, allowing the data clusters to be recovered
until they are overwritten .
Question 11
When performing a logical acquisition of a Linux system, which of the following
is typically captured?
A. Entire raw disk image
B. Only selected files and directories
C. RAM dump
D. BIOS firmware
Answer: B. Only selected files and directories
Rationale: Logical acquisition copies specific files and directories of interest,
rather than an entire disk image. This is faster and focuses on relevant data but may
miss deleted or hidden files .
Question 12
Which of the following statements about SSDs and forensic imaging is true?
A. SSDs never use wear-leveling, so data is stored sequentially
