WGU D431 OA COMPUTER FORENSICS EXAM
SCRIPT 2026 FULL SOLUTION SET GRADED A+
◉ Grand Unified Bootloader (GRUB). Answer: A newer Linux boot
loader.
◉ Graphical user interface (GUI). Answer: A point-and-click user
interface.
◉ grep. Answer: A popular Linux/UNIX search tool.
◉ Hash. Answer: A function that is nonreversible, takes variable-
length input, produces fixed-length output, and has few or no
collisions.
◉ Heap (H). Answer: Dynamic memory for a program comes from
the heap segment. A process may use a memory allocator such as
malloc to request dynamic memory.
◉ Hierarchical storage management (HSM). Answer: Continuous
online backup storage.
,◉ High-level format. Answer: Setting up an empty file system and
installing a boot sector in a drive. Also called a quick format.
◉ Hive. Answer: One of the five sections of the Windows Registry.
◉ Home location register (HLR). Answer: The database used by the
MSC for subscriber data and service information.
◉ Identity theft. Answer: Any use of another person's identity.
◉ Inode. Answer: A data structure in the file system that stores all
the information about a file except its name and its actual data.
◉ Integrated circuit card identifier (ICCID). Answer: A unique serial
number that identifies each SIM. These numbers are engraved on
the SIM during manufacturing.
◉ International Mobile Equipment Identity (IMEI) number. Answer:
A unique number identifying GSM, LTE, and other types of phones.
The first 8 bits of the ESN identify the manufacturer, and the
subsequent 24 bits uniquely identify the phone.
◉ Internet forensics. Answer: The process of piecing together where
and when a user has been on the internet.
,◉ Internet Message Access Protocol (IMAP). Answer: A protocol
used to receive email that works on port 143.
◉ Intrusion detection system. Answer: A system that monitors
network traffic looking for suspicious activity.
◉ ISO9660. Answer: A file system used with CDs.
◉ Kasiski examination. Answer: A method of attacking
polyalphabetic substitution ciphers by deducing the length of the
keyword. This is sometimes also called Kasiski's test or Kasiski's
method.
◉ Kerckhoffs' principle. Answer: The principle that the security of a
cryptographic algorithm depends only on the secrecy of the key, not
the algorithm itself.
◉ Key space. Answer: The total number of keys.
◉ Least significant bit (LSB). Answer: The last bit or least significant
bit is used to store data.
, ◉ Life span. Answer: A term that refers to how long data will last.
The term is related to volatility. More volatile data tends to have a
shorter life span.
◉ LILO (Linux Loader). Answer: One of the Linux boot loaders.
◉ Live system forensics. Answer: The process of searching memory
in real time, typically for working with compromised hosts or to
identify system abuse.
◉ Locard's principle of transference. Answer: The forensics
principle that states you cannot interact with an environment
without leaving some trace.
◉ Logic bomb. Answer: Malware that executes its damage when a
specific condition is met.
◉ Logical analysis. Answer: Analysis involving using the native
operating system, on the evidence disk or a forensic duplicate, to
peruse the data.
◉ Logical damage. Answer: Damage to how the data is stored—for
example, file system corruption.
SCRIPT 2026 FULL SOLUTION SET GRADED A+
◉ Grand Unified Bootloader (GRUB). Answer: A newer Linux boot
loader.
◉ Graphical user interface (GUI). Answer: A point-and-click user
interface.
◉ grep. Answer: A popular Linux/UNIX search tool.
◉ Hash. Answer: A function that is nonreversible, takes variable-
length input, produces fixed-length output, and has few or no
collisions.
◉ Heap (H). Answer: Dynamic memory for a program comes from
the heap segment. A process may use a memory allocator such as
malloc to request dynamic memory.
◉ Hierarchical storage management (HSM). Answer: Continuous
online backup storage.
,◉ High-level format. Answer: Setting up an empty file system and
installing a boot sector in a drive. Also called a quick format.
◉ Hive. Answer: One of the five sections of the Windows Registry.
◉ Home location register (HLR). Answer: The database used by the
MSC for subscriber data and service information.
◉ Identity theft. Answer: Any use of another person's identity.
◉ Inode. Answer: A data structure in the file system that stores all
the information about a file except its name and its actual data.
◉ Integrated circuit card identifier (ICCID). Answer: A unique serial
number that identifies each SIM. These numbers are engraved on
the SIM during manufacturing.
◉ International Mobile Equipment Identity (IMEI) number. Answer:
A unique number identifying GSM, LTE, and other types of phones.
The first 8 bits of the ESN identify the manufacturer, and the
subsequent 24 bits uniquely identify the phone.
◉ Internet forensics. Answer: The process of piecing together where
and when a user has been on the internet.
,◉ Internet Message Access Protocol (IMAP). Answer: A protocol
used to receive email that works on port 143.
◉ Intrusion detection system. Answer: A system that monitors
network traffic looking for suspicious activity.
◉ ISO9660. Answer: A file system used with CDs.
◉ Kasiski examination. Answer: A method of attacking
polyalphabetic substitution ciphers by deducing the length of the
keyword. This is sometimes also called Kasiski's test or Kasiski's
method.
◉ Kerckhoffs' principle. Answer: The principle that the security of a
cryptographic algorithm depends only on the secrecy of the key, not
the algorithm itself.
◉ Key space. Answer: The total number of keys.
◉ Least significant bit (LSB). Answer: The last bit or least significant
bit is used to store data.
, ◉ Life span. Answer: A term that refers to how long data will last.
The term is related to volatility. More volatile data tends to have a
shorter life span.
◉ LILO (Linux Loader). Answer: One of the Linux boot loaders.
◉ Live system forensics. Answer: The process of searching memory
in real time, typically for working with compromised hosts or to
identify system abuse.
◉ Locard's principle of transference. Answer: The forensics
principle that states you cannot interact with an environment
without leaving some trace.
◉ Logic bomb. Answer: Malware that executes its damage when a
specific condition is met.
◉ Logical analysis. Answer: Analysis involving using the native
operating system, on the evidence disk or a forensic duplicate, to
peruse the data.
◉ Logical damage. Answer: Damage to how the data is stored—for
example, file system corruption.
