WGU D829 Task 1 | Digital Forensics Complete Practice Guide | 2026
WGU D829
Task 1 Complete Practice Guide
Digital Forensics in Cybersecurity
Autopsy, Evidence Analysis, Chain of Custody & Forensic Report | 2026
Document Type: Task 1 Complete Practice Guide
Course: WGU D829 - Digital Forensics in Cybersecurity
Academic Year:
Question Count: 40 Multiple-Choice Questions
Structure: 4 Sections | 10 Questions per Section
Cognitive Mix: 30% Recall | 50% Application | 20% Analysis
Question Style: 75% Scenario-Based | 25% Direct
Includes: Complete Solution Key + Grading Rubric
Aligned with 2026/2027 academic and professional standards.
Integrates NIST SP 800-86 guidelines, modern Autopsy modules, and contemporary legal precedents.
Page 1 | WGU D829 Task 1 Practice Guide
,WGU D829 Task 1 | Digital Forensics Complete Practice Guide | 2026
Practice Guide Overview
This Complete Practice Guide for WGU D829 Task 1 assesses mastery across four integrated competency
domains: (1) Digital Forensics Foundations, Legal Framework, and Chain of Custody; (2) Evidence
Acquisition, Forensic Imaging, and Preservation; (3) Autopsy Forensic Suite, File System Analysis, and
Evidence Examination; and (4) Forensic Report Writing, Court Admissibility, and 2026 Updates. The
guide mirrors the cognitive demand profile of the Task 1 performance assessment: 30 percent recall, 50
percent application, and 20 percent analysis, with 75 percent scenario-based items and 25 percent direct
items.
Each question includes the correct answer and a detailed step-by-step rationale explaining the forensic
procedure, legal principle, Autopsy workflow, or report-writing standard, and explicitly identifying why
each distractor represents a forensically unsound, legally inadmissible, or procedurally incorrect action.
Distractors are engineered to reflect the most consequential errors observed in digital forensic practice.
Document Structure
Part Content Questions
Part 1 Examination Questions (40 Items) Q1 - Q40
Sec 1 Foundations, Legal Framework & Chain of Custody Q1 - Q10
Sec 2 Evidence Acquisition, Imaging & Preservation Q11 - Q20
Sec 3 Autopsy, File System Analysis & Examination Q21 - Q30
Sec 4 Report Writing, Court Admissibility & 2026 Updates Q31 - Q40
Part 2 Complete Solution Key (Exemplar Responses) All 40
Part 3 Grading Rubric & Mastery Thresholds Scoring Guide
Page 2 | WGU D829 Task 1 Practice Guide
, WGU D829 Task 1 | Digital Forensics Complete Practice Guide | 2026
PART 1: EXAMINATION QUESTIONS (40 Items)
Instructions: Select the single best answer for each question. Questions are sequenced Q1 through Q40
across four sections. Correct answers and detailed rationales are provided inline beneath each question and
summarized in Part 2.
Section 1: Digital Forensics Foundations, Legal Framework & Chain
of Custody (Q1-Q10)
Q1: Which sequence of phases represents the standard digital forensics lifecycle per NIST SP 800-86?
A. Identification, preservation, collection, examination, analysis, presentation [CORRECT]
B. Collection, deletion, encryption, reporting
C. Seizure, search, verdict
D. Acquisition, hashing, wiping, archiving
Correct Answer: A
Rationale: The forensic lifecycle proceeds identification, preservation, collection, examination, analysis, presentation
per NIST SP 800-86. B includes destructive deletion/wiping; C collapses legal process into a single step; D omits
analysis and presentation.
Q2: An investigator arrives at a powered-on server that must be analyzed. According to the order of
volatility, which data should be collected FIRST?
A. Hard drive sectors at rest
B. Backups stored offsite
C. CPU registers and RAM contents (the most volatile data) [CORRECT]
D. Archived log files on tape
Correct Answer: C
Rationale: Order of volatility dictates collecting the most ephemeral data first (CPU registers, cache, RAM) before it
is lost on power-down. Hard drives (A), offsite backups (B), and tapes (D) are far less volatile and can be acquired
later.
Q3: A private employer (not law enforcement) seizes a company-issued laptop from an employee suspected
of fraud. Which legal framework most directly governs the search of the device?
A. The Fourth Amendment's warrant requirement applies fully, so a judicial warrant is required.
B. The Fourth Amendment generally restrains government action, not private employers, so the search is
governed by company policy and applicable employment/privacy law (unless law enforcement is
involved). [CORRECT]
C. No legal restrictions of any kind apply to private employers.
D. The Daubert standard governs all workplace searches.
Correct Answer: B
Rationale: The Fourth Amendment limits government action, not private-employer workplace searches, which are
governed by policy, contract, and privacy law (Fourth Amendment protections attach if police participate). A
overapplies the amendment; C is false; D confuses expert-testimony admissibility with search authority.
Page 3 | WGU D829 Task 1 Practice Guide
WGU D829
Task 1 Complete Practice Guide
Digital Forensics in Cybersecurity
Autopsy, Evidence Analysis, Chain of Custody & Forensic Report | 2026
Document Type: Task 1 Complete Practice Guide
Course: WGU D829 - Digital Forensics in Cybersecurity
Academic Year:
Question Count: 40 Multiple-Choice Questions
Structure: 4 Sections | 10 Questions per Section
Cognitive Mix: 30% Recall | 50% Application | 20% Analysis
Question Style: 75% Scenario-Based | 25% Direct
Includes: Complete Solution Key + Grading Rubric
Aligned with 2026/2027 academic and professional standards.
Integrates NIST SP 800-86 guidelines, modern Autopsy modules, and contemporary legal precedents.
Page 1 | WGU D829 Task 1 Practice Guide
,WGU D829 Task 1 | Digital Forensics Complete Practice Guide | 2026
Practice Guide Overview
This Complete Practice Guide for WGU D829 Task 1 assesses mastery across four integrated competency
domains: (1) Digital Forensics Foundations, Legal Framework, and Chain of Custody; (2) Evidence
Acquisition, Forensic Imaging, and Preservation; (3) Autopsy Forensic Suite, File System Analysis, and
Evidence Examination; and (4) Forensic Report Writing, Court Admissibility, and 2026 Updates. The
guide mirrors the cognitive demand profile of the Task 1 performance assessment: 30 percent recall, 50
percent application, and 20 percent analysis, with 75 percent scenario-based items and 25 percent direct
items.
Each question includes the correct answer and a detailed step-by-step rationale explaining the forensic
procedure, legal principle, Autopsy workflow, or report-writing standard, and explicitly identifying why
each distractor represents a forensically unsound, legally inadmissible, or procedurally incorrect action.
Distractors are engineered to reflect the most consequential errors observed in digital forensic practice.
Document Structure
Part Content Questions
Part 1 Examination Questions (40 Items) Q1 - Q40
Sec 1 Foundations, Legal Framework & Chain of Custody Q1 - Q10
Sec 2 Evidence Acquisition, Imaging & Preservation Q11 - Q20
Sec 3 Autopsy, File System Analysis & Examination Q21 - Q30
Sec 4 Report Writing, Court Admissibility & 2026 Updates Q31 - Q40
Part 2 Complete Solution Key (Exemplar Responses) All 40
Part 3 Grading Rubric & Mastery Thresholds Scoring Guide
Page 2 | WGU D829 Task 1 Practice Guide
, WGU D829 Task 1 | Digital Forensics Complete Practice Guide | 2026
PART 1: EXAMINATION QUESTIONS (40 Items)
Instructions: Select the single best answer for each question. Questions are sequenced Q1 through Q40
across four sections. Correct answers and detailed rationales are provided inline beneath each question and
summarized in Part 2.
Section 1: Digital Forensics Foundations, Legal Framework & Chain
of Custody (Q1-Q10)
Q1: Which sequence of phases represents the standard digital forensics lifecycle per NIST SP 800-86?
A. Identification, preservation, collection, examination, analysis, presentation [CORRECT]
B. Collection, deletion, encryption, reporting
C. Seizure, search, verdict
D. Acquisition, hashing, wiping, archiving
Correct Answer: A
Rationale: The forensic lifecycle proceeds identification, preservation, collection, examination, analysis, presentation
per NIST SP 800-86. B includes destructive deletion/wiping; C collapses legal process into a single step; D omits
analysis and presentation.
Q2: An investigator arrives at a powered-on server that must be analyzed. According to the order of
volatility, which data should be collected FIRST?
A. Hard drive sectors at rest
B. Backups stored offsite
C. CPU registers and RAM contents (the most volatile data) [CORRECT]
D. Archived log files on tape
Correct Answer: C
Rationale: Order of volatility dictates collecting the most ephemeral data first (CPU registers, cache, RAM) before it
is lost on power-down. Hard drives (A), offsite backups (B), and tapes (D) are far less volatile and can be acquired
later.
Q3: A private employer (not law enforcement) seizes a company-issued laptop from an employee suspected
of fraud. Which legal framework most directly governs the search of the device?
A. The Fourth Amendment's warrant requirement applies fully, so a judicial warrant is required.
B. The Fourth Amendment generally restrains government action, not private employers, so the search is
governed by company policy and applicable employment/privacy law (unless law enforcement is
involved). [CORRECT]
C. No legal restrictions of any kind apply to private employers.
D. The Daubert standard governs all workplace searches.
Correct Answer: B
Rationale: The Fourth Amendment limits government action, not private-employer workplace searches, which are
governed by policy, contract, and privacy law (Fourth Amendment protections attach if police participate). A
overapplies the amendment; C is false; D confuses expert-testimony admissibility with search authority.
Page 3 | WGU D829 Task 1 Practice Guide
