WGU C702 CHFI and OA EXAM
{LATEST 2025-26} QUESTIONS
AND VERIFIED ANSWERS
100% GUARANTEED PASS
Codes of ethics are the principles stated to describe the expected behavior of an investigator
while handling a case. Which of the following is NOT a principle that a computer forensic
investigator must follow? - correct answer Provide personal or prejudiced opinions.
What must an investigator do in order to offer a good report to a court of law and ease the
prosecution? - correct answer Preserve the evidence.
What is the role of an expert witness? - correct answer To educate the public and court.
Which of the following is NOT a legitimate authorizer of a search warrant? - correct answer First
Responder.
Under which of the following circumstances has a court of law allowed investigators to perform
searches without a warrant? - correct answer Delay in obtaining a warrant may lead to the
destruction of evidence and hamper the investigation process.
Which of the following should be considered before planning and evaluating the budget for the
forensic investigation case? - correct answer Breakdown of costs into daily and annual
expenditure.
Which of the following should be physical location and structural design considerations for
forensics labs? - correct answer Lab exteriors should have no windows.
Which of the following should be work area considerations for forensics labs? - correct answer
Examiner station has an area of about 50-63 square feet.
Which of the following is NOT part of the Computer Forensics Investigation Methodology? -
correct answer Testify as an expert defendant.
Which of the following is NOT part of the Computer Forensics Investigation Methodology? -
correct answer Destroy the evidence.
Investigators can immediately take action after receiving a report of a security incident. - correct
answer False.
,In forensics laws, "authenticating or identifying evidences" comes under which rule? - correct
answer Rule 901.
Courts call knowledgable persons to testify to the accuracy of the investigative process. These
people who tesify are known as the: - correct answer Expert witnesses.
A chain of custody is a critical document in the computer forensics investigation process
because the document provides legal validation of appropriate evidence handling. - correct
answer True.
Identify the following which was launched by the National Institute of Standards and
Technology (NIST), that establishes a "methodology for testing computer forensics software
tools by development of general tool specifications, test procedures, test criteria, test sets, and
test hardware." - correct answer Computer Forensic Tool Testing Project (CFTTP)
Which of the following is NOT a digital data storage type? - correct answer Quantum storage
devices.
Which of the following is NOT a common computer file system? - correct answer EFX3
Which field type refers to the volume descriptor as a primary? - correct answer Number 1
Which logical drive holds the information regarding the data and files that are stored in the
disk? - correct answer Extended partition.
How large is the partition table structure that stores information about the partitions present
on the hard disk? - correct answer 64-byte.
How many bits are used by the MBR partition scheme for storing LBAs (Logical Block Addresses)
and the size information on a 512-byte sector? - correct answer 32 bits
in the GUID Partition Table, which Logical Block Address contains the Partition Entry Array? -
correct answer LBA 2
Which of the following describes when the user restarts the system via the operating system? -
correct answer Warm booting.
Which Windows operating system power on and starts up using either the traditional BIOS-MBR
method or the newer UEFI-GPT method? - correct answer Windows 8.
Which item describes the following UEFI boot process phase?
The phase of EFI consisting of initializing the CPU, temporary memory, and boot firmware
volume (BFV); locating and executing the chapters to initialize all the found hardware in the
system; and creating a Hand-Off Block List with all found resources interface descriptors. -
correct answer PEI (Pre-EFI Initialization) Phase.
, Which of the following basic partitioning tools displays details about the GPT partition tables in
Windows OS? - correct answer DiskPart.
What stage of the Linux boot process includes the task of loading the Linux kernel and optional
initial RAM disk? - correct answer Bootloader Stage
What component of a typical FAT32 file system consists of data that the document framework
uses to get to the volume and utilizes the framework parcel to stack the working portion
documents? - correct answer Boot Sector.
Which component of the NTFS architecture is a computer system file driver for NTFS? - correct
answer Ntfs.sys
What is the name of the abstract layer that resides on top of a complete file system, allows
client application to access various file systems, and consists of a dispatching layer and
numerous caches? - correct answer Virtual File System (VFS)
Which information held by the superblock contains major and minor items that allow the
mounting code to determine whether or not supported features are available to the file system?
- correct answer Revision Level.
Which file system used in Linux was developed by Stephen Tweedie in 2001 as a journaling file
system that improves reliability of the system? - correct answer Ext3
How many bit values does HFS use to address allocation blocks? - correct answer 16
What UFS file system part is composed of a few blocks in the partition reserved at the
beginning? - correct answer Boot blocks.
What is a machine readable language used in major digital operations, such as sending and
receiving emails? - correct answer ASCII
What is JPEG an acronym of? - correct answer Joint Photographic Experts Group
What is the proprietary Microsoft Office presentation file extension used in PowerPoint? -
correct answer PPT
Which of the following is an example of optical media? - correct answer CD/DVD
In sector, addressing _______ determines the address of the individual sector on the disk. -
correct answer Cylinders, Heads, and Sectors (CHS)
______ is a 128 bit unique reference number used as an identifier in computer software? -
correct answer Global Unique Identifier (GUID)
Mac OS uses a hierarchical file system. - correct answer True.
{LATEST 2025-26} QUESTIONS
AND VERIFIED ANSWERS
100% GUARANTEED PASS
Codes of ethics are the principles stated to describe the expected behavior of an investigator
while handling a case. Which of the following is NOT a principle that a computer forensic
investigator must follow? - correct answer Provide personal or prejudiced opinions.
What must an investigator do in order to offer a good report to a court of law and ease the
prosecution? - correct answer Preserve the evidence.
What is the role of an expert witness? - correct answer To educate the public and court.
Which of the following is NOT a legitimate authorizer of a search warrant? - correct answer First
Responder.
Under which of the following circumstances has a court of law allowed investigators to perform
searches without a warrant? - correct answer Delay in obtaining a warrant may lead to the
destruction of evidence and hamper the investigation process.
Which of the following should be considered before planning and evaluating the budget for the
forensic investigation case? - correct answer Breakdown of costs into daily and annual
expenditure.
Which of the following should be physical location and structural design considerations for
forensics labs? - correct answer Lab exteriors should have no windows.
Which of the following should be work area considerations for forensics labs? - correct answer
Examiner station has an area of about 50-63 square feet.
Which of the following is NOT part of the Computer Forensics Investigation Methodology? -
correct answer Testify as an expert defendant.
Which of the following is NOT part of the Computer Forensics Investigation Methodology? -
correct answer Destroy the evidence.
Investigators can immediately take action after receiving a report of a security incident. - correct
answer False.
,In forensics laws, "authenticating or identifying evidences" comes under which rule? - correct
answer Rule 901.
Courts call knowledgable persons to testify to the accuracy of the investigative process. These
people who tesify are known as the: - correct answer Expert witnesses.
A chain of custody is a critical document in the computer forensics investigation process
because the document provides legal validation of appropriate evidence handling. - correct
answer True.
Identify the following which was launched by the National Institute of Standards and
Technology (NIST), that establishes a "methodology for testing computer forensics software
tools by development of general tool specifications, test procedures, test criteria, test sets, and
test hardware." - correct answer Computer Forensic Tool Testing Project (CFTTP)
Which of the following is NOT a digital data storage type? - correct answer Quantum storage
devices.
Which of the following is NOT a common computer file system? - correct answer EFX3
Which field type refers to the volume descriptor as a primary? - correct answer Number 1
Which logical drive holds the information regarding the data and files that are stored in the
disk? - correct answer Extended partition.
How large is the partition table structure that stores information about the partitions present
on the hard disk? - correct answer 64-byte.
How many bits are used by the MBR partition scheme for storing LBAs (Logical Block Addresses)
and the size information on a 512-byte sector? - correct answer 32 bits
in the GUID Partition Table, which Logical Block Address contains the Partition Entry Array? -
correct answer LBA 2
Which of the following describes when the user restarts the system via the operating system? -
correct answer Warm booting.
Which Windows operating system power on and starts up using either the traditional BIOS-MBR
method or the newer UEFI-GPT method? - correct answer Windows 8.
Which item describes the following UEFI boot process phase?
The phase of EFI consisting of initializing the CPU, temporary memory, and boot firmware
volume (BFV); locating and executing the chapters to initialize all the found hardware in the
system; and creating a Hand-Off Block List with all found resources interface descriptors. -
correct answer PEI (Pre-EFI Initialization) Phase.
, Which of the following basic partitioning tools displays details about the GPT partition tables in
Windows OS? - correct answer DiskPart.
What stage of the Linux boot process includes the task of loading the Linux kernel and optional
initial RAM disk? - correct answer Bootloader Stage
What component of a typical FAT32 file system consists of data that the document framework
uses to get to the volume and utilizes the framework parcel to stack the working portion
documents? - correct answer Boot Sector.
Which component of the NTFS architecture is a computer system file driver for NTFS? - correct
answer Ntfs.sys
What is the name of the abstract layer that resides on top of a complete file system, allows
client application to access various file systems, and consists of a dispatching layer and
numerous caches? - correct answer Virtual File System (VFS)
Which information held by the superblock contains major and minor items that allow the
mounting code to determine whether or not supported features are available to the file system?
- correct answer Revision Level.
Which file system used in Linux was developed by Stephen Tweedie in 2001 as a journaling file
system that improves reliability of the system? - correct answer Ext3
How many bit values does HFS use to address allocation blocks? - correct answer 16
What UFS file system part is composed of a few blocks in the partition reserved at the
beginning? - correct answer Boot blocks.
What is a machine readable language used in major digital operations, such as sending and
receiving emails? - correct answer ASCII
What is JPEG an acronym of? - correct answer Joint Photographic Experts Group
What is the proprietary Microsoft Office presentation file extension used in PowerPoint? -
correct answer PPT
Which of the following is an example of optical media? - correct answer CD/DVD
In sector, addressing _______ determines the address of the individual sector on the disk. -
correct answer Cylinders, Heads, and Sectors (CHS)
______ is a 128 bit unique reference number used as an identifier in computer software? -
correct answer Global Unique Identifier (GUID)
Mac OS uses a hierarchical file system. - correct answer True.
