WGU C702/ CHFI | Readiness Benchmark Q&A:
Expert-Reviewed Knowledge Test for 2025/2026
Which organization is well known for its online collection of digital forensic guidelines,
best practices, and procedure references? - correct answer c. Swgde
Which application provides a gui commonly used with a command-line forensic toolkit
called the sleuth kit? - correct answer autopsy
Which of the following tools would an investigator use to verify the integrity of a forensic
image before and after an investigation? - correct answer sha1sum
Which of the following is least likely to be a responsibility of a first responder to a
cybersecurity incident? - correct answer offer courtroom testimony as an expert
witness
You are investigating a dos attack called a syn flood. The attacker deliberately violated
the three- way handshake and opened a large number of half- open tcp connections.
What condition would you see if the syn flood attack was successful? - correct answer
c. A large number of syn packets appearing on a network without the corresponding
reply packets
When would a judge most likely allow an investigator's handwritten notes to be used in
court? - correct answer d. When the investigator uses her notes to memory refresh
her while testifying
An nmap scan of a compromised device shows ports 135, 139, and 3389 are all open.
What operating system are you most likely to discover running on the device? - correct
answer windows
A law enforcement officer may only search for and seize criminal evidence with which
are facts or circumstances that would lead a reasonable person to believe that a crime
has been committed or is about to be committed, that evidence of the specific crime
, exists, and that the evidence of the specific crime exists at the place to be searched. -
correct answer probable cause
Which of the following is the main benefit of sharing incident details with partner
organizations or external trusted parties during the incident response process? -
correct answer c. It enhances the response process, as others may be able to
recognize the observed behavior and provide valuable insight.
Which one of these is the process of distributing incorrect ip address/name pairs with
the intent of diverting traffic? - correct answer dns poisoning
Which of the following statements is an incorrect technique in the preservation of digital
evidence? - correct answer turn on the computer and extract log files from event
viewer
You are investigating an incident in which the attacker gained access to a system by
exploiting the windows server smb vulnerability. What command did the attacker most
likely use to disable logging? - correct answer auditpol.exe /disable
What is the primary reason for hashing user passwords? - correct answer it
eliminates the transmission of plaintext passwords
When responding to a network security breach, an incident responder detects that port
80 is open on a web server, but verifies with it staff that the port must remain open so
that the system can fulfill its function. How should the incident responder describe this
condition in the incident response report? - correct answer an exception
Event correlation is a procedure that looks for connections between events that occur in
a predefined interval of time. Which type of correlation would be used in an organization
that employs different operating systems throughout the network? - correct answer
cross-platform correlation
You are a chfi assigned to work in the computer forensics lab of a state police agency.
While working on a high profile criminal case, you have followed every applicable
Expert-Reviewed Knowledge Test for 2025/2026
Which organization is well known for its online collection of digital forensic guidelines,
best practices, and procedure references? - correct answer c. Swgde
Which application provides a gui commonly used with a command-line forensic toolkit
called the sleuth kit? - correct answer autopsy
Which of the following tools would an investigator use to verify the integrity of a forensic
image before and after an investigation? - correct answer sha1sum
Which of the following is least likely to be a responsibility of a first responder to a
cybersecurity incident? - correct answer offer courtroom testimony as an expert
witness
You are investigating a dos attack called a syn flood. The attacker deliberately violated
the three- way handshake and opened a large number of half- open tcp connections.
What condition would you see if the syn flood attack was successful? - correct answer
c. A large number of syn packets appearing on a network without the corresponding
reply packets
When would a judge most likely allow an investigator's handwritten notes to be used in
court? - correct answer d. When the investigator uses her notes to memory refresh
her while testifying
An nmap scan of a compromised device shows ports 135, 139, and 3389 are all open.
What operating system are you most likely to discover running on the device? - correct
answer windows
A law enforcement officer may only search for and seize criminal evidence with which
are facts or circumstances that would lead a reasonable person to believe that a crime
has been committed or is about to be committed, that evidence of the specific crime
, exists, and that the evidence of the specific crime exists at the place to be searched. -
correct answer probable cause
Which of the following is the main benefit of sharing incident details with partner
organizations or external trusted parties during the incident response process? -
correct answer c. It enhances the response process, as others may be able to
recognize the observed behavior and provide valuable insight.
Which one of these is the process of distributing incorrect ip address/name pairs with
the intent of diverting traffic? - correct answer dns poisoning
Which of the following statements is an incorrect technique in the preservation of digital
evidence? - correct answer turn on the computer and extract log files from event
viewer
You are investigating an incident in which the attacker gained access to a system by
exploiting the windows server smb vulnerability. What command did the attacker most
likely use to disable logging? - correct answer auditpol.exe /disable
What is the primary reason for hashing user passwords? - correct answer it
eliminates the transmission of plaintext passwords
When responding to a network security breach, an incident responder detects that port
80 is open on a web server, but verifies with it staff that the port must remain open so
that the system can fulfill its function. How should the incident responder describe this
condition in the incident response report? - correct answer an exception
Event correlation is a procedure that looks for connections between events that occur in
a predefined interval of time. Which type of correlation would be used in an organization
that employs different operating systems throughout the network? - correct answer
cross-platform correlation
You are a chfi assigned to work in the computer forensics lab of a state police agency.
While working on a high profile criminal case, you have followed every applicable
