WGU C840 DIGITAL FORENSICS FINAL
TEST 2026 QUESTIONS WITH CORRECT
ANSWERS GRADED A+
◍ Which method of copying digital evidence ensures proper evidence
collection?.
Answer: Make the copy at the bit-level
◍ Test system.
Answer: A functional system compatible with the hard drive from which
someone is trying to recover data.
◍ How does a rainbow table work to crack a password?.
Answer: It uses a table of all possible keyboard combinations and their hash
values, then searches for a match.
◍ The following line of code is an example of how to make a forensic copy of
a suspect drive: dd if=/dev/mem of=/evidence/image.memory1 Which
operating system should be used to run this command?.
Answer: Linux
◍ Computer forensics.
Answer: The use of analytical and investigative techniques to identify,
collect, examine, and preserve computer-based material for presentation as
evidence in a court of law.
◍ NIST 800-72.
Answer: 4 states a device can be in when data is extracted
◍ Sniffer.
Answer: The chief information officer of an accounting firm believes
sensitive data is being exposed on the local network. Which tool should the
, IT staff use to gather digital evidence about this security vulnerability? a)
Snifferb) Tracerc) Disk analyzerd) Virus scanner
◍ CVSS (Common Vulnerability Scoring System).
Answer: A risk management approach to quantifying vulnerability data and
then taking into account the degree of risk to different types of systems or
information.
◍ Foreign Intelligence Surveillance Act of 1978 (FISA).
Answer: A U.S. law that prescribes procedures for the physical and
electronic surveillance and collection of "foreign intelligence information"
between foreign powers and agents of foreign powers, which may include
U.S. citizens and permanent residents suspected of espionage or terrorism.
◍ The Telecommunications Act of 1996.
Answer: Includes many provisions relative to the privacy and disclosure of
information in motion through and across telephony and computer networks.
◍ §1028A.
Answer: ID theft and aggravated ID theft
◍ .Trashes\501.
Answer: When a file is deleted on the iPhone, iPad, or iPod, it is actually
moved to this folder. Essentially, the data is still there until it is overwritten,
so recently deleted files can be retrieved.
◍ §2701.
Answer: covers illicit access to a facility to obtain/alter communications
◍ Visitor location register (VLR).
Answer: A database used by the MSC for roaming phones.
◍ Block cipher.
Answer: A form of cryptography that encrypts data in blocks; 64-bit blocks
are quite common, although some algorithms (like AES) use larger blocks.
◍ Swap file.
Answer: A virtual memory extension of RAM that can be temporary or
, permanent.
◍ Routing table.
Answer: A table used with routers to track what IP addresses are connected
to ports on the router.
◍ Where on a Windows system is the config folder located that contains the
SAM file?.
Answer: C:\Windows\System32
◍ Long Term Evolution (LTE).
Answer: A standard for wireless communication of high-speed data for
mobile devices. This is what is commonly called 4G.
◍ In what order should evidence be collected?.
Answer: You must start with collecting the most volatile evidence and
proceed to the least volatile. Ex: Collect Volatile, then Temporary, then
Permanent
◍ Children's Online Privacy Protection Act of 1998.
Answer: protects children 13 years of age and under from the collection and
use of their personal information by websites.
◍ Payload.
Answer: The data to be covertly communicated. In other words, it is the
message you want to hide.
◍ Enhanced data rates for GSM evolution (EDGE).
Answer: A technology that does not fit neatly into the 2G/3G/4G spectrum.
It is technically considered pre-3G but was an improvement on GSM (2G).
◍ Forensic Toolkit (FTK).
Answer: A system administrator believes an employee is leaking
information to a competitor by hiding confidential data in images being
attached to outgoing emails. The administrator has captured the outgoing
emails. Which tool should the forensic investigator use to search for the
hidden data in the images? a) Forensic Toolkit (FTK)b) Snowc) Data Doctor
, d) Wolf
◍ The Digital Millennium Copyright Act (DMCA).
Answer: This controversial law was enacted in 1998. It makes it a crime to
publish methods or techniques to circumvent copyright protection. It is
controversial because it has been used against legitimate researchers
publishing research papers.
◍ Telecommunications Act of 1996.
Answer: allows disclosure of information through and across telephony and
computer networks
◍ Digital Millenium Copyright Act (DMCA).
Answer: states it's a crime to circumvent copyright protection
◍ Which types of data are the authorities allowed to get from service
providers?.
Answer: The ECPA requires different legal processes to obtain specific
types of information: *Basic subscriber information*: includes name,
address, billing information including a credit card number, telephone toll
billing records, subscriber’s telephone number, type of service, and length of
service. An investigator can obtain this type of information with a subpoena,
court order, or search warrant. *Transactional information*: includes
websites visited, email addresses of others with whom the subscriber
exchanged email, and buddy lists. An investigator can obtain this type of
information with a court order or search warrant. *Content information*: An
investigator who has a search warrant can obtain content information from
retrieved email messages and also acquire unretrieved stored emails.
*Real-time access*: To intercept traffic as it is sent or received, an
investigator needs to obtain a wiretap order.
◍ Forensic tools for iOS devices.
Answer: PwnageRecover My iPodAPowerSoftiMyPhone iPhone Analyzer
◍ Unlawful Access to Stored Communications (18 U.S.C. § 2701).
Answer: This act covers access to a facility through which electronic
TEST 2026 QUESTIONS WITH CORRECT
ANSWERS GRADED A+
◍ Which method of copying digital evidence ensures proper evidence
collection?.
Answer: Make the copy at the bit-level
◍ Test system.
Answer: A functional system compatible with the hard drive from which
someone is trying to recover data.
◍ How does a rainbow table work to crack a password?.
Answer: It uses a table of all possible keyboard combinations and their hash
values, then searches for a match.
◍ The following line of code is an example of how to make a forensic copy of
a suspect drive: dd if=/dev/mem of=/evidence/image.memory1 Which
operating system should be used to run this command?.
Answer: Linux
◍ Computer forensics.
Answer: The use of analytical and investigative techniques to identify,
collect, examine, and preserve computer-based material for presentation as
evidence in a court of law.
◍ NIST 800-72.
Answer: 4 states a device can be in when data is extracted
◍ Sniffer.
Answer: The chief information officer of an accounting firm believes
sensitive data is being exposed on the local network. Which tool should the
, IT staff use to gather digital evidence about this security vulnerability? a)
Snifferb) Tracerc) Disk analyzerd) Virus scanner
◍ CVSS (Common Vulnerability Scoring System).
Answer: A risk management approach to quantifying vulnerability data and
then taking into account the degree of risk to different types of systems or
information.
◍ Foreign Intelligence Surveillance Act of 1978 (FISA).
Answer: A U.S. law that prescribes procedures for the physical and
electronic surveillance and collection of "foreign intelligence information"
between foreign powers and agents of foreign powers, which may include
U.S. citizens and permanent residents suspected of espionage or terrorism.
◍ The Telecommunications Act of 1996.
Answer: Includes many provisions relative to the privacy and disclosure of
information in motion through and across telephony and computer networks.
◍ §1028A.
Answer: ID theft and aggravated ID theft
◍ .Trashes\501.
Answer: When a file is deleted on the iPhone, iPad, or iPod, it is actually
moved to this folder. Essentially, the data is still there until it is overwritten,
so recently deleted files can be retrieved.
◍ §2701.
Answer: covers illicit access to a facility to obtain/alter communications
◍ Visitor location register (VLR).
Answer: A database used by the MSC for roaming phones.
◍ Block cipher.
Answer: A form of cryptography that encrypts data in blocks; 64-bit blocks
are quite common, although some algorithms (like AES) use larger blocks.
◍ Swap file.
Answer: A virtual memory extension of RAM that can be temporary or
, permanent.
◍ Routing table.
Answer: A table used with routers to track what IP addresses are connected
to ports on the router.
◍ Where on a Windows system is the config folder located that contains the
SAM file?.
Answer: C:\Windows\System32
◍ Long Term Evolution (LTE).
Answer: A standard for wireless communication of high-speed data for
mobile devices. This is what is commonly called 4G.
◍ In what order should evidence be collected?.
Answer: You must start with collecting the most volatile evidence and
proceed to the least volatile. Ex: Collect Volatile, then Temporary, then
Permanent
◍ Children's Online Privacy Protection Act of 1998.
Answer: protects children 13 years of age and under from the collection and
use of their personal information by websites.
◍ Payload.
Answer: The data to be covertly communicated. In other words, it is the
message you want to hide.
◍ Enhanced data rates for GSM evolution (EDGE).
Answer: A technology that does not fit neatly into the 2G/3G/4G spectrum.
It is technically considered pre-3G but was an improvement on GSM (2G).
◍ Forensic Toolkit (FTK).
Answer: A system administrator believes an employee is leaking
information to a competitor by hiding confidential data in images being
attached to outgoing emails. The administrator has captured the outgoing
emails. Which tool should the forensic investigator use to search for the
hidden data in the images? a) Forensic Toolkit (FTK)b) Snowc) Data Doctor
, d) Wolf
◍ The Digital Millennium Copyright Act (DMCA).
Answer: This controversial law was enacted in 1998. It makes it a crime to
publish methods or techniques to circumvent copyright protection. It is
controversial because it has been used against legitimate researchers
publishing research papers.
◍ Telecommunications Act of 1996.
Answer: allows disclosure of information through and across telephony and
computer networks
◍ Digital Millenium Copyright Act (DMCA).
Answer: states it's a crime to circumvent copyright protection
◍ Which types of data are the authorities allowed to get from service
providers?.
Answer: The ECPA requires different legal processes to obtain specific
types of information: *Basic subscriber information*: includes name,
address, billing information including a credit card number, telephone toll
billing records, subscriber’s telephone number, type of service, and length of
service. An investigator can obtain this type of information with a subpoena,
court order, or search warrant. *Transactional information*: includes
websites visited, email addresses of others with whom the subscriber
exchanged email, and buddy lists. An investigator can obtain this type of
information with a court order or search warrant. *Content information*: An
investigator who has a search warrant can obtain content information from
retrieved email messages and also acquire unretrieved stored emails.
*Real-time access*: To intercept traffic as it is sent or received, an
investigator needs to obtain a wiretap order.
◍ Forensic tools for iOS devices.
Answer: PwnageRecover My iPodAPowerSoftiMyPhone iPhone Analyzer
◍ Unlawful Access to Stored Communications (18 U.S.C. § 2701).
Answer: This act covers access to a facility through which electronic
