WGU D431 OA Exam UPDATED
ACTUAL QUESTIONS AND CORRECT
ANSWERS
.pst - CORRECT ANSWER Outlook
.ost - CORRECT ANSWER Offline Outlook Storage
.mbx - CORRECT ANSWER Outlook Express
.dbx - CORRECT ANSWER Outlook Express
.mbx - CORRECT ANSWER Eudora
Which storage tech uses NAND? - CORRECT ANSWER SSD
What uses AFF file format? - CORRECT ANSWER Autopsy and Sleuth Kit
Which tool makes a bit-by-bit copy of a windows 8 phone? - CORRECT ANSWER FTK
What is used to unlock iphone? - CORRECT ANSWER XRY
What is Data Doctor? - CORRECT ANSWER simrestore
How does windows store pw? - CORRECT ANSWER hash
Where do deleted Apple iphone/ipad files go? - CORRECT ANSWER /.Trashes/501
Pwnage - CORRECT ANSWER This utility allows you to unlock a locked ipod Touch
, This is probably the most important log from a forensics point of view. It has both successful and
unsuccessful login events. - CORRECT ANSWER Security log
This is a very important directory to look at for evidence. - CORRECT ANSWER
C:\Users\username\Documents
Where will Windows store the hash_______in the Windows system directory - CORRECT ANSWER
SAM (Security Accounts Manager) file
_____is the information to be hidden - CORRECT ANSWER Payload
The _____is the signal, stream, or file in which the payload is hidden. - CORRECT ANSWER
Carrier
The _____is the type of medium used. This may be a passive channel, such as photos, video, or sound
files, or even an active channel, such as a Voice over IP (voip) voice call or streaming video
connection. - CORRECT ANSWER Channel
_____is particularly useful at cracking passwords. - CORRECT ANSWER Forensic Toolkit
(FTK)
The ______from accessdata is another widely used forensics analysis tool is also very popular with
law enforcement. - CORRECT ANSWER Forensic Toolkit (FTK)
The evidence file is an exact copy of the hard drive. _____calculates an MD5 hash when the drive is
acquired. The hash is used to check for changes, alterations, or errors. - CORRECT ANSWER
encase
Because there are no moving parts, these drives are resilient to shock damage (i.e., dropping them
probably won't hurt them. - CORRECT ANSWER USB thumb drives
The _____was invented by Basis Technology - CORRECT ANSWER advanced forensic file
format (AFF)
ACTUAL QUESTIONS AND CORRECT
ANSWERS
.pst - CORRECT ANSWER Outlook
.ost - CORRECT ANSWER Offline Outlook Storage
.mbx - CORRECT ANSWER Outlook Express
.dbx - CORRECT ANSWER Outlook Express
.mbx - CORRECT ANSWER Eudora
Which storage tech uses NAND? - CORRECT ANSWER SSD
What uses AFF file format? - CORRECT ANSWER Autopsy and Sleuth Kit
Which tool makes a bit-by-bit copy of a windows 8 phone? - CORRECT ANSWER FTK
What is used to unlock iphone? - CORRECT ANSWER XRY
What is Data Doctor? - CORRECT ANSWER simrestore
How does windows store pw? - CORRECT ANSWER hash
Where do deleted Apple iphone/ipad files go? - CORRECT ANSWER /.Trashes/501
Pwnage - CORRECT ANSWER This utility allows you to unlock a locked ipod Touch
, This is probably the most important log from a forensics point of view. It has both successful and
unsuccessful login events. - CORRECT ANSWER Security log
This is a very important directory to look at for evidence. - CORRECT ANSWER
C:\Users\username\Documents
Where will Windows store the hash_______in the Windows system directory - CORRECT ANSWER
SAM (Security Accounts Manager) file
_____is the information to be hidden - CORRECT ANSWER Payload
The _____is the signal, stream, or file in which the payload is hidden. - CORRECT ANSWER
Carrier
The _____is the type of medium used. This may be a passive channel, such as photos, video, or sound
files, or even an active channel, such as a Voice over IP (voip) voice call or streaming video
connection. - CORRECT ANSWER Channel
_____is particularly useful at cracking passwords. - CORRECT ANSWER Forensic Toolkit
(FTK)
The ______from accessdata is another widely used forensics analysis tool is also very popular with
law enforcement. - CORRECT ANSWER Forensic Toolkit (FTK)
The evidence file is an exact copy of the hard drive. _____calculates an MD5 hash when the drive is
acquired. The hash is used to check for changes, alterations, or errors. - CORRECT ANSWER
encase
Because there are no moving parts, these drives are resilient to shock damage (i.e., dropping them
probably won't hurt them. - CORRECT ANSWER USB thumb drives
The _____was invented by Basis Technology - CORRECT ANSWER advanced forensic file
format (AFF)
