Page 1 of 125
WGU D829 Digital Forensics Complete
Incident Report | Comprehensive Analysis,
Findings & Documentation
Exam Coverage Summary
Topics Covered:
✓ Digital Forensics Fundamentals & Frameworks
✓ Evidence Collection & Chain of Custody
✓ File Systems & Data Storage (FAT, NTFS, inodes, MBR, GPT)
✓ Cryptography (Symmetric, Asymmetric, Block, Stream Ciphers)
✓ Steganography & Steganalysis
✓ Mobile Device Forensics (GSM, LTE, SIM, IMEI)
✓ Network Forensics & Protocols (SMTP, POP3, IMAP)
✓ Legal Frameworks (FISA, CALEA, DMCA, PATRIOT Act)
✓ Malware Analysis (Viruses, Logic Bombs)
✓ Incident Response & Disaster Recovery
✓ Windows Registry & System Logs
✓ Memory Forensics & Volatile Data
✓ Anti-Forensics Techniques
, Page 2 of 125
✓ Expert Testimony & Evidence Admissibility
Question 1
A forensic investigator is examining a hard drive that was seized from a suspect's home. The
investigator notices that the drive has been formatted with a file system that uses a table to store
cluster/file information. This table contains entries that point to the location of files on the drive.
Which component is the investigator examining?
A) Master Boot Record
B) File Allocation Table
C) GUID Partition Table
D) Inode Table
: B) File Allocation Table
Rationale: The File Allocation Table (FAT) is specifically designed to store cluster/file
information, tracking which clusters are allocated to which files. The MBR initiates booting,
GPT is a partition table format, and inodes store file information in UNIX/Linux file systems.
Question 2
During a forensic investigation of a corporate network breach, the investigator needs to
determine which protocol the attacker used to send email messages from compromised accounts.
The investigator observes traffic on port 25. Which protocol is being used?
A) POP3
B) IMAP
C) SMTP
D) HTTP
: C) SMTP
, Page 3 of 125
Rationale: Simple Mail Transfer Protocol (SMTP) is the standard protocol for sending email and
operates on port 25. POP3 uses port 110, IMAP uses port 143, and HTTP uses port 80.
Question 3
A digital forensics analyst is preparing to testify in court about the methods used to extract data
from a suspect's smartphone. The opposing counsel questions whether the analysis methods are
scientifically valid. Which standard should the analyst reference to demonstrate that the methods
are widely accepted in the scientific community?
A) Frye Standard
B) Daubert Standard
C) Federal Rules of Evidence
D) Locard's Principle
: B) Daubert Standard
Rationale: The Daubert standard holds that only methods and tools widely accepted in the
scientific community can be used in court. This standard ensures scientific validity and reliability
of forensic methodologies.
Question 4
A security team discovers that an attacker has encrypted sensitive company data using a
cryptographic method where two different keys are used: one to encrypt and another to decrypt.
What type of cryptography is the attacker using?
A) Symmetric cryptography
B) Block cipher
C) Asymmetric cryptography
D) Stream cipher
: C) Asymmetric cryptography
, Page 4 of 125
Rationale: Asymmetric cryptography uses two different keys - a public key for encryption and a
private key for decryption. This differs from symmetric cryptography where the same key
performs both functions.
Question 5
In a child exploitation investigation, law enforcement discovers that a suspect has been using a
technique to hide messages within image files on their computer. The investigator suspects that
the hidden data is embedded in the least significant bits of the image pixels. What technique is
being used?
A) Cryptanalysis
B) Steganography
C) Encryption
D) Hashing
: B) Steganography
Rationale: Steganography is the art and science of writing hidden messages within other files or
communications. The least significant bit (LSB) technique is a common steganographic method
where data is hidden in the last bits of image pixels.
Question 6
A forensic investigator is analyzing a compromised Windows system and needs to examine the
registry hives to identify suspicious activity. Which of the following is NOT one of the five
sections of the Windows Registry?
A) HKEY_LOCAL_MACHINE
B) HKEY_USERS
C) HKEY_CURRENT_CONFIG
D) HKEY_ROOT
: D) HKEY_ROOT
WGU D829 Digital Forensics Complete
Incident Report | Comprehensive Analysis,
Findings & Documentation
Exam Coverage Summary
Topics Covered:
✓ Digital Forensics Fundamentals & Frameworks
✓ Evidence Collection & Chain of Custody
✓ File Systems & Data Storage (FAT, NTFS, inodes, MBR, GPT)
✓ Cryptography (Symmetric, Asymmetric, Block, Stream Ciphers)
✓ Steganography & Steganalysis
✓ Mobile Device Forensics (GSM, LTE, SIM, IMEI)
✓ Network Forensics & Protocols (SMTP, POP3, IMAP)
✓ Legal Frameworks (FISA, CALEA, DMCA, PATRIOT Act)
✓ Malware Analysis (Viruses, Logic Bombs)
✓ Incident Response & Disaster Recovery
✓ Windows Registry & System Logs
✓ Memory Forensics & Volatile Data
✓ Anti-Forensics Techniques
, Page 2 of 125
✓ Expert Testimony & Evidence Admissibility
Question 1
A forensic investigator is examining a hard drive that was seized from a suspect's home. The
investigator notices that the drive has been formatted with a file system that uses a table to store
cluster/file information. This table contains entries that point to the location of files on the drive.
Which component is the investigator examining?
A) Master Boot Record
B) File Allocation Table
C) GUID Partition Table
D) Inode Table
: B) File Allocation Table
Rationale: The File Allocation Table (FAT) is specifically designed to store cluster/file
information, tracking which clusters are allocated to which files. The MBR initiates booting,
GPT is a partition table format, and inodes store file information in UNIX/Linux file systems.
Question 2
During a forensic investigation of a corporate network breach, the investigator needs to
determine which protocol the attacker used to send email messages from compromised accounts.
The investigator observes traffic on port 25. Which protocol is being used?
A) POP3
B) IMAP
C) SMTP
D) HTTP
: C) SMTP
, Page 3 of 125
Rationale: Simple Mail Transfer Protocol (SMTP) is the standard protocol for sending email and
operates on port 25. POP3 uses port 110, IMAP uses port 143, and HTTP uses port 80.
Question 3
A digital forensics analyst is preparing to testify in court about the methods used to extract data
from a suspect's smartphone. The opposing counsel questions whether the analysis methods are
scientifically valid. Which standard should the analyst reference to demonstrate that the methods
are widely accepted in the scientific community?
A) Frye Standard
B) Daubert Standard
C) Federal Rules of Evidence
D) Locard's Principle
: B) Daubert Standard
Rationale: The Daubert standard holds that only methods and tools widely accepted in the
scientific community can be used in court. This standard ensures scientific validity and reliability
of forensic methodologies.
Question 4
A security team discovers that an attacker has encrypted sensitive company data using a
cryptographic method where two different keys are used: one to encrypt and another to decrypt.
What type of cryptography is the attacker using?
A) Symmetric cryptography
B) Block cipher
C) Asymmetric cryptography
D) Stream cipher
: C) Asymmetric cryptography
, Page 4 of 125
Rationale: Asymmetric cryptography uses two different keys - a public key for encryption and a
private key for decryption. This differs from symmetric cryptography where the same key
performs both functions.
Question 5
In a child exploitation investigation, law enforcement discovers that a suspect has been using a
technique to hide messages within image files on their computer. The investigator suspects that
the hidden data is embedded in the least significant bits of the image pixels. What technique is
being used?
A) Cryptanalysis
B) Steganography
C) Encryption
D) Hashing
: B) Steganography
Rationale: Steganography is the art and science of writing hidden messages within other files or
communications. The least significant bit (LSB) technique is a common steganographic method
where data is hidden in the last bits of image pixels.
Question 6
A forensic investigator is analyzing a compromised Windows system and needs to examine the
registry hives to identify suspicious activity. Which of the following is NOT one of the five
sections of the Windows Registry?
A) HKEY_LOCAL_MACHINE
B) HKEY_USERS
C) HKEY_CURRENT_CONFIG
D) HKEY_ROOT
: D) HKEY_ROOT
