WGU C840
WGU C840 DIGITAL FORENSICS CHAPTER 1-15
ASSESSMENTS EXAM QUESTIONS AND ANSWERS
In a computer forensics investigation, this describes the route that
evidence takes from the time you find it until the case is closed or goes
to court.
A. Rules of evidence
B. Law of probability
C. Chain of custody
D. Policy of separation - correct answer C. Chain of custody
If the computer is turned on when you arrive, what does the Secret
Service recommend you do?
,WGU C840
A. Begin your investigation immediately.
B. Shut the computer down according to the recommended Secret
Service procedure.
C. Transport the computer with power on.
D. Unplug the machine immediately. - correct answer B. Shut the computer
down according to the recommended Secret Service procedure
Why should you note all cable connections for a computer you want to
seize as evidence?
A. To know what outside connections existed
B. In case other devices were connected
C. To know what peripheral devices existed
D. To know what hardware existed - correct answer B. In case other devices
were connected
What is the essence of the Daubert standard?
A. That only experts can testify at trial
B. That an expert must affirm that a tool or technique is valid
C. That only tools or techniques that have been accepted by the
scientific community are admissible at trial
,WGU C840
D. That the chain of custody must be preserved - correct answer C. That
only tools or techniques that have been accepted by the scientific
community are admissible at trial
When cataloging digital evidence, the primary goal is to do what?
A. Make bitstream images of all hard drives.
B. Preserve evidence integrity.
C. Keep evidence from being removed from the scene.
D. Keep the computer from being turned off. - correct answer B. Preserve
evidence integrity
Which of the following is important to the investigator regarding
logging?
A. The logging methods
B. Log retention
C. Location of stored logs
D. All of the above - correct answer D. All of the above
Your roommate can give consent to search your computer.
A. True
, WGU C840
B. False - correct answer B. False
Evidence need not be locked if it is at a police station.
A. True
B. False - correct answer B. False
When investigating a virus, what is the first step?
A. Check firewall logs.
B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus. - correct answer C. Document the virus
Which of the following crimes is most likely to leave email evidence?
A. Cyberstalking
B. DoS
C. Logic bomb
D. Fraud - correct answer A. Cyberstalking
WGU C840 DIGITAL FORENSICS CHAPTER 1-15
ASSESSMENTS EXAM QUESTIONS AND ANSWERS
In a computer forensics investigation, this describes the route that
evidence takes from the time you find it until the case is closed or goes
to court.
A. Rules of evidence
B. Law of probability
C. Chain of custody
D. Policy of separation - correct answer C. Chain of custody
If the computer is turned on when you arrive, what does the Secret
Service recommend you do?
,WGU C840
A. Begin your investigation immediately.
B. Shut the computer down according to the recommended Secret
Service procedure.
C. Transport the computer with power on.
D. Unplug the machine immediately. - correct answer B. Shut the computer
down according to the recommended Secret Service procedure
Why should you note all cable connections for a computer you want to
seize as evidence?
A. To know what outside connections existed
B. In case other devices were connected
C. To know what peripheral devices existed
D. To know what hardware existed - correct answer B. In case other devices
were connected
What is the essence of the Daubert standard?
A. That only experts can testify at trial
B. That an expert must affirm that a tool or technique is valid
C. That only tools or techniques that have been accepted by the
scientific community are admissible at trial
,WGU C840
D. That the chain of custody must be preserved - correct answer C. That
only tools or techniques that have been accepted by the scientific
community are admissible at trial
When cataloging digital evidence, the primary goal is to do what?
A. Make bitstream images of all hard drives.
B. Preserve evidence integrity.
C. Keep evidence from being removed from the scene.
D. Keep the computer from being turned off. - correct answer B. Preserve
evidence integrity
Which of the following is important to the investigator regarding
logging?
A. The logging methods
B. Log retention
C. Location of stored logs
D. All of the above - correct answer D. All of the above
Your roommate can give consent to search your computer.
A. True
, WGU C840
B. False - correct answer B. False
Evidence need not be locked if it is at a police station.
A. True
B. False - correct answer B. False
When investigating a virus, what is the first step?
A. Check firewall logs.
B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus. - correct answer C. Document the virus
Which of the following crimes is most likely to leave email evidence?
A. Cyberstalking
B. DoS
C. Logic bomb
D. Fraud - correct answer A. Cyberstalking
