WGU C795 EXAMINATION 2026 SET QUESTIONS AND
SOLUTIONS RATED A+
✔✔You need to protect data on computer networks from power spikes.
What should you use?
A key card
B heating system
C surge suppressor
D sprinkler - ✔✔C
✔✔During a recent incident investigation, you extracted hidden data from the data
image that was created.
In which step of the incident investigation process were you involved?
A collection
B preservation
C identification
D examination - ✔✔D
✔✔You are performing a forensic investigation of a recent computer security breach.
You have been asked to use disk imaging to create a copy of a hard drive's contents.
Which statement is true of disk imaging when performed in a forensic investigation?
A The original copy of the disk should be used.
B A bit-level copy of the disk assists in the forensic investigation.
C A byte-level copy of the disk assists in the forensic investigation.
D The content of the memory should not be dumped. - ✔✔B
✔✔Your organization implements a full/differential backup scheme. A full backup was
completed two days ago. Yesterday, a differential backup was completed.
Which files were backed up yesterday?
A all files in a backup set that were changed or created since the last incremental
backup
B all files in a backup set that were changed or created since the last full backup
C all files in a backup set
D all files in a backup set that were changed or created since the last differential backup
- ✔✔B
,✔✔Over the next weekend, your team is scheduled to perform tests that include
shutting down the live site and bringing the alternate site up to full operation.
Which test will be performed?
A parallel test
B structured walk-though test
C simulation test
D full-interruption test - ✔✔D
✔✔Which statement is true of a computer crime investigation?
A Evidence is not important from a legal perspective.
B The company's incident response team is sometimes unwilling to involve law
enforcement authorities.
C The investigation cost often proves to be a deterrent before the investigation begins.
D Evidence is not easy to modify during investigation. - ✔✔B
✔✔Your organization has created an exhaustive disaster recovery plan.
When should it be implemented?
A after all systems are back online
B when the company is in emergency mode
C when the company is in normal operation mode
D after the critical systems are back online - ✔✔B
✔✔What is the first step of the equipment life cycle?
A Procurement and Deployment
B Management
C Retirement
D Assessment - ✔✔D
✔✔At which point should a configuration change be documented to the change log?
A after the change is approved
B after the change is tested
C after the change is implemented
D after the change is requested - ✔✔C
✔✔What device lock prevents access to hard drives or unused ports in a computer?
A port control
B peripheral switch control
, C cable trap
D slot lock
E switch control - ✔✔A
✔✔Your organization is researching alternate computing facilities to ensure that the
organization is able to function if the primary facility is destroyed.
What is the most important consideration when choosing an alternate computing
facility?
A cost
B amount of time facility needed
C location
D resources available - ✔✔C
✔✔Which arrangement enables you to identify fraudulent activity by allowing an
employee to perform more than one role in the organization?
A mandatory vacations
B segregation of duties
C dual control
D job rotation - ✔✔D
✔✔What access control principle ensures that a particular role has more that one
person trained to perform its duties?
A job rotation
B implicit deny
C least pribvilege
D separation of duties - ✔✔A
✔✔Which statement is true of lighting of critical areas?
A Critical areas should use standby lighting and be illuminated ten feet in height to two
foot-candles.
B Critical areas should use standby lighting and be illuminated eight feet in height to two
foot-candles.
C Critical areas should use standby lighting and be illuminated ten feet in height to four
foot-candles.
D Critical areas should use emergency lighting and be illuminated six feet in height to
two foot-candles. - ✔✔B
✔✔Which of the following business continuity exercises can be quite involved and
should be performed annually?
SOLUTIONS RATED A+
✔✔You need to protect data on computer networks from power spikes.
What should you use?
A key card
B heating system
C surge suppressor
D sprinkler - ✔✔C
✔✔During a recent incident investigation, you extracted hidden data from the data
image that was created.
In which step of the incident investigation process were you involved?
A collection
B preservation
C identification
D examination - ✔✔D
✔✔You are performing a forensic investigation of a recent computer security breach.
You have been asked to use disk imaging to create a copy of a hard drive's contents.
Which statement is true of disk imaging when performed in a forensic investigation?
A The original copy of the disk should be used.
B A bit-level copy of the disk assists in the forensic investigation.
C A byte-level copy of the disk assists in the forensic investigation.
D The content of the memory should not be dumped. - ✔✔B
✔✔Your organization implements a full/differential backup scheme. A full backup was
completed two days ago. Yesterday, a differential backup was completed.
Which files were backed up yesterday?
A all files in a backup set that were changed or created since the last incremental
backup
B all files in a backup set that were changed or created since the last full backup
C all files in a backup set
D all files in a backup set that were changed or created since the last differential backup
- ✔✔B
,✔✔Over the next weekend, your team is scheduled to perform tests that include
shutting down the live site and bringing the alternate site up to full operation.
Which test will be performed?
A parallel test
B structured walk-though test
C simulation test
D full-interruption test - ✔✔D
✔✔Which statement is true of a computer crime investigation?
A Evidence is not important from a legal perspective.
B The company's incident response team is sometimes unwilling to involve law
enforcement authorities.
C The investigation cost often proves to be a deterrent before the investigation begins.
D Evidence is not easy to modify during investigation. - ✔✔B
✔✔Your organization has created an exhaustive disaster recovery plan.
When should it be implemented?
A after all systems are back online
B when the company is in emergency mode
C when the company is in normal operation mode
D after the critical systems are back online - ✔✔B
✔✔What is the first step of the equipment life cycle?
A Procurement and Deployment
B Management
C Retirement
D Assessment - ✔✔D
✔✔At which point should a configuration change be documented to the change log?
A after the change is approved
B after the change is tested
C after the change is implemented
D after the change is requested - ✔✔C
✔✔What device lock prevents access to hard drives or unused ports in a computer?
A port control
B peripheral switch control
, C cable trap
D slot lock
E switch control - ✔✔A
✔✔Your organization is researching alternate computing facilities to ensure that the
organization is able to function if the primary facility is destroyed.
What is the most important consideration when choosing an alternate computing
facility?
A cost
B amount of time facility needed
C location
D resources available - ✔✔C
✔✔Which arrangement enables you to identify fraudulent activity by allowing an
employee to perform more than one role in the organization?
A mandatory vacations
B segregation of duties
C dual control
D job rotation - ✔✔D
✔✔What access control principle ensures that a particular role has more that one
person trained to perform its duties?
A job rotation
B implicit deny
C least pribvilege
D separation of duties - ✔✔A
✔✔Which statement is true of lighting of critical areas?
A Critical areas should use standby lighting and be illuminated ten feet in height to two
foot-candles.
B Critical areas should use standby lighting and be illuminated eight feet in height to two
foot-candles.
C Critical areas should use standby lighting and be illuminated ten feet in height to four
foot-candles.
D Critical areas should use emergency lighting and be illuminated six feet in height to
two foot-candles. - ✔✔B
✔✔Which of the following business continuity exercises can be quite involved and
should be performed annually?
