WGU D431 Digital Forensics Objective Assessment Exam
Updated 2026 Questions and Detailed Answers|| Graded
A+|| Latest Update 2026
Which law requires both parties to consent to the recording of a
conversation? - ANSWER >>>>ECPA (Electronic
Communications Privacy Act)
Which law is related to the disclosure of personally identifiable
protected health information (PHI)? - ANSWER >>>>Health
Insurance Portability and Accountability Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a
misleading domain name with the intent to deceive a minor into
viewing harmful material? - ANSWER >>>>18 U.S.C. 2252B
Which U.S. law protects journalists from turning over their work or
sources to law enforcement before the information is shared with
the public? - ANSWER >>>>The Privacy Protection Act (PPA)
Which law or guideline lists the four states a mobile device can be
in when data is extracted from it? - ANSWER >>>>NIST SP 800-
72 Guidelines
Which law includes a provision permitting the wiretapping of VoIP
calls? - ANSWER >>>>Communications Assistance to Law
Enforcement Act (CALEA)
Which policy is included in the CAN-SPAM Act? - ANSWER
>>>>The email sender must provide some mechanism whereby
,the receiver can opt out of future emails and that method cannot
require the receiver to pay in order to opt out.
Which United States law requires telecommunications equipment
manufacturers to provide built-in surveillance capabilities for
federal agencies? - ANSWER >>>>Communication Assistance to
Law Enforcement Act (CALEA)
Which law requires a search warrant or one of the recognized
exceptions to the search warrant requirements for searching
email messages on a computer? - ANSWER >>>>The Fourth
Amendment to the U.S. Constitution
Where are local passwords stored for the Windows operating
system? - ANSWER >>>>SAM file in \Windows\System32\
Where on a Windows system is the config folder located that
contains the SAM file? - ANSWER >>>>C:\Windows\System32
A forensic examiner wants to try to extract passwords for wireless
networks to which a system was connected. Where should
passwords for wireless networks be stored on a Windows XP
system? - ANSWER >>>>Registry
Which Windows password cracking tool uses rainbow tables? -
ANSWER >>>>Ophcrack
How does a rainbow table work to crack a password? - ANSWER
>>>>It uses a table of all possible keyboard combinations and
their hash values, then searches for a match.
What should a forensic investigator use to gather the most
reliable routing information for tracking an email message? -
ANSWER >>>>Email header
,Which activity involves email tracing? - ANSWER
>>>>Determining the ownership of the source email server
A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were
any mounted volumes created from USB drives. Which digital
evidence should be reviewed? - ANSWER >>>>/var/log
Which log or folder contains information about printed documents
on a computer running Mac OS X? - ANSWER
>>>>/var/spool/cups
Which Windows event log should be checked for evidence of
invalid logon attempts? - ANSWER >>>>Security
A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh
system to ensure the system has been patched. Which folder
contains the software updates logs? - ANSWER
>>>>/Library/Receipts
A forensic investigator wants to image an older BlackBerry
smartphone running OS 7.0. Which tool should the investigator
use? - ANSWER >>>>BlackBerry Desktop Manager
An investigator wants to extract information from a mobile device
by connecting it to a computer. What should the investigator take
great care to ensure? - ANSWER >>>>That the mobile device
does not synchronize with the computer
Which state is a device in if it is powered on, performing tasks,
and able to be manipulated by the user? - ANSWER >>>>Active
, The chief information officer of an accounting firm believes
sensitive data is being exposed on the local network. Which tool
should the IT staff use to gather digital evidence about this
security vulnerability? - ANSWER >>>>Sniffer
A police detective investigating a threat traces the source to a
house. The couple at the house shows the detective the only
computer the family owns, which is in their son's bedroom. The
couple states that their son is presently in class at a local middle
school. How should the detective legally gain access to the
computer? - ANSWER >>>>Obtain consent to search from the
parents
How should a forensic scientist obtain the network configuration
from a Windows PC before seizing it from a crime scene? -
ANSWER >>>>By using the ipconfig command from a command
prompt on the computer
The human resources manager of a small accounting firm
believes he may have been a victim of a phishing scam. The
manager clicked on a link in an email message that asked him to
verify the logon credentials for the firm's online bank account.
Which digital evidence should a forensic investigator collect to
investigate this incident? - ANSWER >>>>Browser Cache
After a company's single-purpose, dedicated messaging server is
hacked by a cybercriminal, a forensics expert is hired to
investigate the crime and collect evidence.Which digital evidence
should be collected? - ANSWER >>>>Firewall Logs
Thomas received an email stating that he needed to follow a link
and verify his bank account information to ensure it was secure.
Shortly after following the instructions, Thomas noticed money
was missing from his account. Which digital evidence should be
Considered To Determine How Thomas' Account Information Was
Compromised? - Answer >>>>Email Messages
The Chief Executive Officer (Ceo) Of A Small Computer
Updated 2026 Questions and Detailed Answers|| Graded
A+|| Latest Update 2026
Which law requires both parties to consent to the recording of a
conversation? - ANSWER >>>>ECPA (Electronic
Communications Privacy Act)
Which law is related to the disclosure of personally identifiable
protected health information (PHI)? - ANSWER >>>>Health
Insurance Portability and Accountability Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a
misleading domain name with the intent to deceive a minor into
viewing harmful material? - ANSWER >>>>18 U.S.C. 2252B
Which U.S. law protects journalists from turning over their work or
sources to law enforcement before the information is shared with
the public? - ANSWER >>>>The Privacy Protection Act (PPA)
Which law or guideline lists the four states a mobile device can be
in when data is extracted from it? - ANSWER >>>>NIST SP 800-
72 Guidelines
Which law includes a provision permitting the wiretapping of VoIP
calls? - ANSWER >>>>Communications Assistance to Law
Enforcement Act (CALEA)
Which policy is included in the CAN-SPAM Act? - ANSWER
>>>>The email sender must provide some mechanism whereby
,the receiver can opt out of future emails and that method cannot
require the receiver to pay in order to opt out.
Which United States law requires telecommunications equipment
manufacturers to provide built-in surveillance capabilities for
federal agencies? - ANSWER >>>>Communication Assistance to
Law Enforcement Act (CALEA)
Which law requires a search warrant or one of the recognized
exceptions to the search warrant requirements for searching
email messages on a computer? - ANSWER >>>>The Fourth
Amendment to the U.S. Constitution
Where are local passwords stored for the Windows operating
system? - ANSWER >>>>SAM file in \Windows\System32\
Where on a Windows system is the config folder located that
contains the SAM file? - ANSWER >>>>C:\Windows\System32
A forensic examiner wants to try to extract passwords for wireless
networks to which a system was connected. Where should
passwords for wireless networks be stored on a Windows XP
system? - ANSWER >>>>Registry
Which Windows password cracking tool uses rainbow tables? -
ANSWER >>>>Ophcrack
How does a rainbow table work to crack a password? - ANSWER
>>>>It uses a table of all possible keyboard combinations and
their hash values, then searches for a match.
What should a forensic investigator use to gather the most
reliable routing information for tracking an email message? -
ANSWER >>>>Email header
,Which activity involves email tracing? - ANSWER
>>>>Determining the ownership of the source email server
A forensic examiner reviews a laptop running OS X which has
been compromised. The examiner wants to know if there were
any mounted volumes created from USB drives. Which digital
evidence should be reviewed? - ANSWER >>>>/var/log
Which log or folder contains information about printed documents
on a computer running Mac OS X? - ANSWER
>>>>/var/spool/cups
Which Windows event log should be checked for evidence of
invalid logon attempts? - ANSWER >>>>Security
A cyber security organization has issued a warning about a
cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator
decides to examine the software updates logs on a Macintosh
system to ensure the system has been patched. Which folder
contains the software updates logs? - ANSWER
>>>>/Library/Receipts
A forensic investigator wants to image an older BlackBerry
smartphone running OS 7.0. Which tool should the investigator
use? - ANSWER >>>>BlackBerry Desktop Manager
An investigator wants to extract information from a mobile device
by connecting it to a computer. What should the investigator take
great care to ensure? - ANSWER >>>>That the mobile device
does not synchronize with the computer
Which state is a device in if it is powered on, performing tasks,
and able to be manipulated by the user? - ANSWER >>>>Active
, The chief information officer of an accounting firm believes
sensitive data is being exposed on the local network. Which tool
should the IT staff use to gather digital evidence about this
security vulnerability? - ANSWER >>>>Sniffer
A police detective investigating a threat traces the source to a
house. The couple at the house shows the detective the only
computer the family owns, which is in their son's bedroom. The
couple states that their son is presently in class at a local middle
school. How should the detective legally gain access to the
computer? - ANSWER >>>>Obtain consent to search from the
parents
How should a forensic scientist obtain the network configuration
from a Windows PC before seizing it from a crime scene? -
ANSWER >>>>By using the ipconfig command from a command
prompt on the computer
The human resources manager of a small accounting firm
believes he may have been a victim of a phishing scam. The
manager clicked on a link in an email message that asked him to
verify the logon credentials for the firm's online bank account.
Which digital evidence should a forensic investigator collect to
investigate this incident? - ANSWER >>>>Browser Cache
After a company's single-purpose, dedicated messaging server is
hacked by a cybercriminal, a forensics expert is hired to
investigate the crime and collect evidence.Which digital evidence
should be collected? - ANSWER >>>>Firewall Logs
Thomas received an email stating that he needed to follow a link
and verify his bank account information to ensure it was secure.
Shortly after following the instructions, Thomas noticed money
was missing from his account. Which digital evidence should be
Considered To Determine How Thomas' Account Information Was
Compromised? - Answer >>>>Email Messages
The Chief Executive Officer (Ceo) Of A Small Computer
