WGU DIGITAL FORENSICS IN
CYBERSECURITY D431 TASK 1
CERTIFICATION SCRIPT 2026 QUESTIONS
WITH SOLUTIONS GRADED A+
◍ What are the three basic tasks that a systems forensic specialist must keep in
mind when handling evidence during a cybercrime investigation? Answer
options may be used more than once or not at all. Select your answers from
the pull-down list.Find evidenceCatalog evidenceDisseminate
evidencePreserve evidencePrepare evidencePrepare evidence reportMake
multiple copies of evidence.
Answer: Find evidencePreserve evidencePrepare evidence
◍ Thomas received an email stating that he needed to follow a link and verify
his bank account information to ensure it was secure. Shortly after following
the instructions, Thomas noticed money was missing from his account.
Which digital evidence should be considered to determine how Thomas'
account information was compromised?Flash drive contents Social media
accounts Email messages Router logs.
Answer: Email messages
◍ An investigator wants to extract information from a mobile device by
connecting it to a computer. What should the investigator take great care to
ensure?
A. That the mobile device does not synchronize with the computer
B. That the mobile device is updated with the latest operating system
C. That proper step information is written to the mobile device
D. That current time stamps of forensics activities are written to the device.
Answer: A. That the mobile device does not synchronize with the computer
,◍ What is the starting point for investigating denial-of-service attacks?
A. Firewall logs
B. Email headers
C. System logs
D. Tracing the packets.
Answer: D. Tracing the packets
◍ Which law includes a provision permitting the wiretapping of VoIP calls?
A. Communications Assistance to Law Enforcement Act (CALEA)
B. USA Patriot Act
C. Electronic Communications Privacy Act (ECPA)
D. Sarbanes-Oxley Act (SOX).
Answer: A. Communications Assistance to Law Enforcement Act (CALEA)
◍ After a company's single-purpose, dedicated messaging server is hacked by
a cybercriminal, a forensics expert is hired to investigate the crime and
collect evidence.Which digital evidence should be collected?
A. Firewall logs
B. Workstation logs
C. Phishing emails
D. Spam messages.
Answer: A. Firewall logs
◍ Which method is commonly used to hide data via
steganography?LSBAESDESRSA.
Answer: LSB
◍ The Communications Assistance to Law Enforcement Act of 1994.
Answer: a federal wiretap law
◍ Which method of copying digital evidence ensures proper evidence
collection?Make the copy at the bit-levelCopy files using drag and
dropMake the copy using file transferCopy the logical partitions.
Answer: Make the copy at the bit-level
◍ The human resources manager of a small accounting firm believes he may
, have been a victim of a phishing scam. The manager clicked on a link in an
email message that asked him to verify the logon credentials for the firm's
online bank account. Which digital evidence should a forensic investigator
collect to investigate this incident?Browser cache Security log System log
Disk cache.
Answer: Browser cache
◍ The Children's Online Privacy Protection Act of 1998.
Answer: protects children 13 years of age and under from the collection and
use of their personal information by websites.
◍ The Privacy Protection Act of 1980.
Answer: protects journalists from being required to turn over to law
enforcement any work product and documentary materials, including
sources, before it is disseminated to the public
◍ What is an SQL injection?A) A type of malwareB) A network attackC) A
database vulnerabilityD) A social engineering attack.
Answer: C) A database vulnerability
◍ Which tool can unlock and extract data from iPhones?
A. FTK
B. Cellebrite
C. XRY
D. EnCase.
Answer: C. XRY
◍ When investigating a virus, what is the first step?
A. Check firewall logs.
B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus..
Answer: C. Document the virus.
◍ Which type of storage format should be transported in a special bag to
reduce electrostatic interference?Solid-state drivesOptical mediaDigital
CYBERSECURITY D431 TASK 1
CERTIFICATION SCRIPT 2026 QUESTIONS
WITH SOLUTIONS GRADED A+
◍ What are the three basic tasks that a systems forensic specialist must keep in
mind when handling evidence during a cybercrime investigation? Answer
options may be used more than once or not at all. Select your answers from
the pull-down list.Find evidenceCatalog evidenceDisseminate
evidencePreserve evidencePrepare evidencePrepare evidence reportMake
multiple copies of evidence.
Answer: Find evidencePreserve evidencePrepare evidence
◍ Thomas received an email stating that he needed to follow a link and verify
his bank account information to ensure it was secure. Shortly after following
the instructions, Thomas noticed money was missing from his account.
Which digital evidence should be considered to determine how Thomas'
account information was compromised?Flash drive contents Social media
accounts Email messages Router logs.
Answer: Email messages
◍ An investigator wants to extract information from a mobile device by
connecting it to a computer. What should the investigator take great care to
ensure?
A. That the mobile device does not synchronize with the computer
B. That the mobile device is updated with the latest operating system
C. That proper step information is written to the mobile device
D. That current time stamps of forensics activities are written to the device.
Answer: A. That the mobile device does not synchronize with the computer
,◍ What is the starting point for investigating denial-of-service attacks?
A. Firewall logs
B. Email headers
C. System logs
D. Tracing the packets.
Answer: D. Tracing the packets
◍ Which law includes a provision permitting the wiretapping of VoIP calls?
A. Communications Assistance to Law Enforcement Act (CALEA)
B. USA Patriot Act
C. Electronic Communications Privacy Act (ECPA)
D. Sarbanes-Oxley Act (SOX).
Answer: A. Communications Assistance to Law Enforcement Act (CALEA)
◍ After a company's single-purpose, dedicated messaging server is hacked by
a cybercriminal, a forensics expert is hired to investigate the crime and
collect evidence.Which digital evidence should be collected?
A. Firewall logs
B. Workstation logs
C. Phishing emails
D. Spam messages.
Answer: A. Firewall logs
◍ Which method is commonly used to hide data via
steganography?LSBAESDESRSA.
Answer: LSB
◍ The Communications Assistance to Law Enforcement Act of 1994.
Answer: a federal wiretap law
◍ Which method of copying digital evidence ensures proper evidence
collection?Make the copy at the bit-levelCopy files using drag and
dropMake the copy using file transferCopy the logical partitions.
Answer: Make the copy at the bit-level
◍ The human resources manager of a small accounting firm believes he may
, have been a victim of a phishing scam. The manager clicked on a link in an
email message that asked him to verify the logon credentials for the firm's
online bank account. Which digital evidence should a forensic investigator
collect to investigate this incident?Browser cache Security log System log
Disk cache.
Answer: Browser cache
◍ The Children's Online Privacy Protection Act of 1998.
Answer: protects children 13 years of age and under from the collection and
use of their personal information by websites.
◍ The Privacy Protection Act of 1980.
Answer: protects journalists from being required to turn over to law
enforcement any work product and documentary materials, including
sources, before it is disseminated to the public
◍ What is an SQL injection?A) A type of malwareB) A network attackC) A
database vulnerabilityD) A social engineering attack.
Answer: C) A database vulnerability
◍ Which tool can unlock and extract data from iPhones?
A. FTK
B. Cellebrite
C. XRY
D. EnCase.
Answer: C. XRY
◍ When investigating a virus, what is the first step?
A. Check firewall logs.
B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus..
Answer: C. Document the virus.
◍ Which type of storage format should be transported in a special bag to
reduce electrostatic interference?Solid-state drivesOptical mediaDigital
