WGU D829 Digital Forensics Complete Practice Questions and
Correct Answers Graded A & Ultimate Exam Prep Bundle (ABC
Tech Incident Report Mastery Guide) | 2026/2027
Ace your WGU D829 Digital Forensics Assessment with this ultimate Q&A Practice
Bank! Pass on your first attempt using expert questions mapped to the ABC Tech
incident report rubric. Master Windows Registry, Autopsy 4.22.0, FTK Imager,
volatile memory, and the Chain of Custody. Includes comprehensive Rationales
tailored for rapid learning. Don't risk a costly revision—download the most
comprehensive study bundle on Stuvia and lock in your pass today!
,Part 1: Windows Artifacts & Registry Forensics (Questions 1–15)
1. A forensic analyst needs to prove that a specific application was executed on a Windows
system, even though the user deleted the executable. Which artifact provides a history
of executed programs, including file path, execution counter, and last run time?
• A) Shell bags
• B) Prefetch files (.pf)
• C) Link files (.lnk)
• D) Master File Table ($MFT)
Rationale: Prefetch files (.pf) are created by Windows to optimize application loading,
storing execution history, file paths, run counts, and timestamps, even if the primary
binary is deleted. Shell bags track folder viewing preferences, Link files track file
openings, and the $MFT is the core NTFS structural directory file.
2. During an investigation of unauthorized file browsing, the examiner needs to show that a
user navigated to a specific hidden directory using Windows Explorer. Which registry
hive and artifact should be parsed?
• A) SYSTEM hive - Shimcache
• B) NTUSER.DAT hive - Shellbags
• C) SOFTWARE hive - RunMRU
• D) AMCACHE.hve - Device configurations
Rationale: Shellbags, stored within the user's NTUSER.DAT (and UsrClass.dat) registry
, hive, record the access and viewing preferences of folders in Windows Explorer, proving a
user navigated to a specific directory.
3. An incident report requires finding when a USB storage device was first connected to a
suspect Windows machine. Which registry key natively stores information regarding the
vendor, product ID, and serial number of connected USB mass storage devices?
• A) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• B) HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
• C) HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
• D) HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Rationale: The USBSTOR registry key tracks comprehensive historical connection metrics
of external storage units, including unique serial numbers and hardware metadata
identifiers.
4. An attacker logged into a target system remotely using compromised credentials. The
forensic team must identify successful logins. Which specific Windows Security Event ID
tracks a successful user account authentication event?
• A) Event ID 4625
• B) Event ID 4624
• C) Event ID 7045
• D) Event ID 1102
Rationale: Security Event ID 4624 maps exclusively to successful logon authentications.
Event ID 4625 tracks failed attempts, 7045 tracks new service creations, and 1102
indicates log clearing activities.
5. In an unauthorized RDP activity analysis, you notice a successful logon event with a
Logon Type of 3. What does this specific logon type indicate about how the system was
accessed?
• A) Interactive (Local Keyboard and Mouse)
• B) Remote Desktop Protocol (RDP)
• C) Network-based logon (e.g., shared folder or IIS web server)
• D) Service Startup
Rationale: Logon Type 3 indicates a network-based authentication, such as connecting to
, a shared drive or a website. Local interactive logons are Type 2, and RDP is specifically
categorized as Logon Type 10.
6. A user claims they never opened a malicious document found on their desktop. The
forensic analyst locates a shortcut file pointing to the document inside the user profile's
"Recent" folder. What information can a shortcut (.lnk) file reveal to disprove the user's
claim?
• A) The complete plain-text password used to create the document
• B) The target file’s creation date, modified date, and volume serial number
• C) The entire bitstream block contents of the unallocated space
• D) The external IP address of the remote cloud server hosting the file
Rationale: Link (.lnk) files contain metadata about target files, including structural MACB
timestamps, local volume serial paths, and internal size variables, which prove file
interactions.
7. Which Windows artifact resides in the root directory of a volume and records
transactional metadata updates for NTFS file records, allowing an investigator to
reconstruct recent file creation, deletion, or renaming activities?
• A) $Bitmap
• B) $LogFile
• C) $BadClust
• D) $Boot
Rationale: LogFile records transaction operations on an NTFS partition to enable
recovery. Bitmap tracks sector allocations, BadClust catalogs physically damaged sectors,
and Boot stores partition system boot files.
8. A suspect modifies the system clock backward to spoof file creation timelines. Which
specific NTFS attribute tracking mechanism captures the reliable, non-user-modifiable
record of file changes, visible via deep MFT parsing?
• A) $STANDARD_INFORMATION via Windows API
• B) $FILE_NAME attribute metadata timestamps
• C) Prefetch execution counter fields
• D) Browser cache expiration profiles
Rationale: The $FILE_NAME attribute inside the Master File Table (MFT) can generally
Correct Answers Graded A & Ultimate Exam Prep Bundle (ABC
Tech Incident Report Mastery Guide) | 2026/2027
Ace your WGU D829 Digital Forensics Assessment with this ultimate Q&A Practice
Bank! Pass on your first attempt using expert questions mapped to the ABC Tech
incident report rubric. Master Windows Registry, Autopsy 4.22.0, FTK Imager,
volatile memory, and the Chain of Custody. Includes comprehensive Rationales
tailored for rapid learning. Don't risk a costly revision—download the most
comprehensive study bundle on Stuvia and lock in your pass today!
,Part 1: Windows Artifacts & Registry Forensics (Questions 1–15)
1. A forensic analyst needs to prove that a specific application was executed on a Windows
system, even though the user deleted the executable. Which artifact provides a history
of executed programs, including file path, execution counter, and last run time?
• A) Shell bags
• B) Prefetch files (.pf)
• C) Link files (.lnk)
• D) Master File Table ($MFT)
Rationale: Prefetch files (.pf) are created by Windows to optimize application loading,
storing execution history, file paths, run counts, and timestamps, even if the primary
binary is deleted. Shell bags track folder viewing preferences, Link files track file
openings, and the $MFT is the core NTFS structural directory file.
2. During an investigation of unauthorized file browsing, the examiner needs to show that a
user navigated to a specific hidden directory using Windows Explorer. Which registry
hive and artifact should be parsed?
• A) SYSTEM hive - Shimcache
• B) NTUSER.DAT hive - Shellbags
• C) SOFTWARE hive - RunMRU
• D) AMCACHE.hve - Device configurations
Rationale: Shellbags, stored within the user's NTUSER.DAT (and UsrClass.dat) registry
, hive, record the access and viewing preferences of folders in Windows Explorer, proving a
user navigated to a specific directory.
3. An incident report requires finding when a USB storage device was first connected to a
suspect Windows machine. Which registry key natively stores information regarding the
vendor, product ID, and serial number of connected USB mass storage devices?
• A) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• B) HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
• C) HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
• D) HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
Rationale: The USBSTOR registry key tracks comprehensive historical connection metrics
of external storage units, including unique serial numbers and hardware metadata
identifiers.
4. An attacker logged into a target system remotely using compromised credentials. The
forensic team must identify successful logins. Which specific Windows Security Event ID
tracks a successful user account authentication event?
• A) Event ID 4625
• B) Event ID 4624
• C) Event ID 7045
• D) Event ID 1102
Rationale: Security Event ID 4624 maps exclusively to successful logon authentications.
Event ID 4625 tracks failed attempts, 7045 tracks new service creations, and 1102
indicates log clearing activities.
5. In an unauthorized RDP activity analysis, you notice a successful logon event with a
Logon Type of 3. What does this specific logon type indicate about how the system was
accessed?
• A) Interactive (Local Keyboard and Mouse)
• B) Remote Desktop Protocol (RDP)
• C) Network-based logon (e.g., shared folder or IIS web server)
• D) Service Startup
Rationale: Logon Type 3 indicates a network-based authentication, such as connecting to
, a shared drive or a website. Local interactive logons are Type 2, and RDP is specifically
categorized as Logon Type 10.
6. A user claims they never opened a malicious document found on their desktop. The
forensic analyst locates a shortcut file pointing to the document inside the user profile's
"Recent" folder. What information can a shortcut (.lnk) file reveal to disprove the user's
claim?
• A) The complete plain-text password used to create the document
• B) The target file’s creation date, modified date, and volume serial number
• C) The entire bitstream block contents of the unallocated space
• D) The external IP address of the remote cloud server hosting the file
Rationale: Link (.lnk) files contain metadata about target files, including structural MACB
timestamps, local volume serial paths, and internal size variables, which prove file
interactions.
7. Which Windows artifact resides in the root directory of a volume and records
transactional metadata updates for NTFS file records, allowing an investigator to
reconstruct recent file creation, deletion, or renaming activities?
• A) $Bitmap
• B) $LogFile
• C) $BadClust
• D) $Boot
Rationale: LogFile records transaction operations on an NTFS partition to enable
recovery. Bitmap tracks sector allocations, BadClust catalogs physically damaged sectors,
and Boot stores partition system boot files.
8. A suspect modifies the system clock backward to spoof file creation timelines. Which
specific NTFS attribute tracking mechanism captures the reliable, non-user-modifiable
record of file changes, visible via deep MFT parsing?
• A) $STANDARD_INFORMATION via Windows API
• B) $FILE_NAME attribute metadata timestamps
• C) Prefetch execution counter fields
• D) Browser cache expiration profiles
Rationale: The $FILE_NAME attribute inside the Master File Table (MFT) can generally
