WGU C702 EXAM 2025/2026 QUESTIONS
AND ANSWERS 100% PASS.
A software company suspects that employees have set up automatic corporate email
forwarding to their personal inboxes against company policy. The company hires forensic
investigators to identify the employees violating policy, with the intention of issuing warnings to
them.
Which type of cybercrime investigation approach is this company taking?
Civil
Criminal
Administrative
Punitive - ANS Administrative
Which model or legislation applies a holistic approach toward any criminal activity as a criminal
operation?
Enterprise Theory of Investigation
Racketeer Influenced and Corrupt Organizations Act
Evidence Examination
Law Enforcement Cyber Incident Reporting - ANS Enterprise Theory of Investigation
1 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
,What does a forensic investigator need to obtain before seizing a computing device in a criminal
case?
Court warrant
Completed crime report
Chain of custody document
Plaintiff's permission - ANS Court warrant
Which activity should be used to check whether an application has ever been installed on a
computer?
Penetration test
Risk analysis
Log review
Security review - ANS Log review
Which characteristic describes an organization's forensic readiness in the context of
cybercrimes?
It includes moral considerations.
It includes cost considerations.
It excludes nontechnical actions.
It excludes technical actions. - ANS It includes cost considerations.
A cybercrime investigator identifies a Universal Serial Bus (USB) memory stick containing emails
as a primary piece of evidence.
Who must sign the chain of custody document once the USB stick is in evidence?
Those who obtain access to the device
2 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
, Anyone who has ever used the device
Recipients of emails on the device
Authors of emails on the device - ANS Those who obtain access to the device
Which type of attack is a denial-of-service technique that sends a large amount of data to
overwhelm system resources?
Phishing
Spamming
Mail bombing
Bluejacking - ANS Mail bombing
Which computer crime forensics step requires an investigator to duplicate and image the
collected digital information?
Securing evidence
Acquiring data
Analyzing data
Assessing evidence - ANS Acquiring data
What is the last step of a criminal investigation that requires the involvement of a computer
forensic investigator?
Analyzing the data collected
Testifying in court
Assessing the evidence
Performing search and seizure - ANS Testifying in court
How can a forensic investigator verify an Android mobile device is on, without potentially
changing the original evidence or interacting with the operating system?
3 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
AND ANSWERS 100% PASS.
A software company suspects that employees have set up automatic corporate email
forwarding to their personal inboxes against company policy. The company hires forensic
investigators to identify the employees violating policy, with the intention of issuing warnings to
them.
Which type of cybercrime investigation approach is this company taking?
Civil
Criminal
Administrative
Punitive - ANS Administrative
Which model or legislation applies a holistic approach toward any criminal activity as a criminal
operation?
Enterprise Theory of Investigation
Racketeer Influenced and Corrupt Organizations Act
Evidence Examination
Law Enforcement Cyber Incident Reporting - ANS Enterprise Theory of Investigation
1 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
,What does a forensic investigator need to obtain before seizing a computing device in a criminal
case?
Court warrant
Completed crime report
Chain of custody document
Plaintiff's permission - ANS Court warrant
Which activity should be used to check whether an application has ever been installed on a
computer?
Penetration test
Risk analysis
Log review
Security review - ANS Log review
Which characteristic describes an organization's forensic readiness in the context of
cybercrimes?
It includes moral considerations.
It includes cost considerations.
It excludes nontechnical actions.
It excludes technical actions. - ANS It includes cost considerations.
A cybercrime investigator identifies a Universal Serial Bus (USB) memory stick containing emails
as a primary piece of evidence.
Who must sign the chain of custody document once the USB stick is in evidence?
Those who obtain access to the device
2 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
, Anyone who has ever used the device
Recipients of emails on the device
Authors of emails on the device - ANS Those who obtain access to the device
Which type of attack is a denial-of-service technique that sends a large amount of data to
overwhelm system resources?
Phishing
Spamming
Mail bombing
Bluejacking - ANS Mail bombing
Which computer crime forensics step requires an investigator to duplicate and image the
collected digital information?
Securing evidence
Acquiring data
Analyzing data
Assessing evidence - ANS Acquiring data
What is the last step of a criminal investigation that requires the involvement of a computer
forensic investigator?
Analyzing the data collected
Testifying in court
Assessing the evidence
Performing search and seizure - ANS Testifying in court
How can a forensic investigator verify an Android mobile device is on, without potentially
changing the original evidence or interacting with the operating system?
3 @COPYRIGHT 2025/2026 ALLRIGHTS RESERVED.
