WGU C840 DIGITAL FORENSICS
CERTIFICATION SCRIPT 2026 QUESTIONS
WITH SOLUTIONS GRADED A+
◍ Email forensics.
Answer: The study of the source and content of email as evidence, including
the identification of the sender, recipient, date, time, and origination location
of an email message.
◍ XRY.
Answer: Tool for breaking an iPhone passcode.
◍ Data consistency.
Answer: The act of ensuring the data that is extracted is consistent.
◍ Logical damage.
Answer: Damage to how the data is stored—for example, file system
corruption.
◍ 18 USC 1030 Fraud and Related Activity in Connection with Computers.
Answer: This is one of the most widely used laws in hacking cases. It covers
a wide range of crimes involving illicit access of any computer.
◍ 18 USC 1020 Fraud and Related Activity in Connection with Access
Devices.
Answer: This is closely related to 1030 but covers access devices (such as
routers).
◍ Which law or guideline lists the four states a mobile device can be in when
data is extracted from it?.
Answer: NIST SP 800-72 Guidelines
◍ Logical imaging.
, Answer: Use of the target system's file system to copy data to an image for
analysis.
◍ Three-way handshake.
Answer: The process of connecting to a server that involves three packets
being exchanged.
◍ A forensic investigator wants to image an older BlackBerry smartphone
running OS 7.0. Which tool should the investigator use?.
Answer: BlackBerry Desktop Manager
◍ The chief information officer of an accounting firm believes sensitive data is
being exposed on the local network. Which tool should the IT staff use to
gather digital evidence about this security vulnerability?.
Answer: Sniffer
◍ Permanent denial of service (PDoS).
Answer: an attack that damages the system so badly the machine needs a full
reinstall of its OS and potentially even new hardware.
◍ What should a forensic investigator use to gather the most reliable routing
information for tracking an email message?.
Answer: Email header
◍ BASH shell.
Answer: The command prompt in Mac OS, can execute Linux commands.
◍ A computer involved in a crime is infected with malware. The computer is
on and connected to the company's network. The forensic investigator
arrives at the scene. Which action should be the investigator's first step?.
Answer: Unplug the computer's Ethernet cable
◍ Moore's law.
Answer: The observation by Gordon Moore of Intel Corporation that
capacity would double and price would be cut in half roughly every 18 to 24
months for products based on computer chips and related technology.
◍ Brute-force attack.
, Answer: An attack in which the attacker tries to decrypt a message by
simply applying every possible key in the keyspace.
◍ Which tools can do a check for steganography?.
Answer: Forensic Toolkit (FTK) and EnCase both check for steganography,
and FTK has an entire image detection engine devoted to this task.
◍ How do forensic specialists show that digital evidence was handled in a
protected, secure manner during the process of collecting and analyzing the
evidence?.
Answer: Chain of custody
◍ Polymorphic virus.
Answer: literally changes its form from time to time to avoid detection by
antivirus software. A more advanced form of this is called the Metamorphic
virus; it can completely rewrite itself.
◍ Slurred image.
Answer: The result of acquiring a file as it is being updated.
◍ Personal unlocking code (PUK).
Answer: A number for unlocking a cell phone.
◍ Common Forensic Software Programs.
Answer: EnCase from Guidance SoftwareForensic Toolkit (FTK) from
AccessDataSleuth KitAutopsyDisk Investigator
◍ Data Doctor.
Answer: Recovers all Inbox and Outbox data and all contacts data, and has
an easy-to-use interface.
◍ Host protected area (HPA).
Answer: This was designed as an area where computer vendors could store
data that is protected from user activities and operating system utilities, such
as delete and format. To hide data in the this area, a person would need to
write a program to access it and write the data.
◍ Internet Message Access Protocol (IMAP).
, Answer: A protocol used to receive email that works on port 143.
◍ Both magnetic and solid-state drives include a few features that are
important for forensics:.
Answer: Host protected area (HPA)Master boot record (MBR)Volume
slackUnallocated spaceGood blocks marked as badFile slack
◍ A foreign government is communicating with its agents in the U.S. by
hiding text messages in popular American songs, which are uploaded to the
web. Which steganographic tool can be used to do this?.
Answer: MP3Stego
◍ Physical imaging.
Answer: Making a physical copy of a disk.
◍ DFRWS Framework The Digital Forensic Research Workshop (DFRWS).
Answer: Identification Preservation Collection Examination Analysis
Presentation
◍ Memory-resident virus.
Answer: installs itself and then remains in RAM from the time the computer
is booted up to when it is shut down.
◍ Event-Based Digital Forensics Investigation Framework.
Answer: Readiness phase - contains the Operations Readiness subphase:
training people and testing investigation tools, and the Infrastructure
Readiness subphase: configuring the equipmentDeployment phase- includes
the Detection and Notification subphase: someone detects an incident and
alerts investigators, and the Confirmation and Authorization subphase:
investigators receive authorization to conduct the investigationPhysical
Crime Scene Investigation phase Digital Crime Scene Investigation phase
Presentation phase
◍ A cyber security organization has issued a warning about a cybercriminal
who is using a known vulnerability to attack unpatched corporate Macintosh
systems. A network administrator decides to examine the software updates
logs on a Macintosh system to ensure the system has been patched. Which
CERTIFICATION SCRIPT 2026 QUESTIONS
WITH SOLUTIONS GRADED A+
◍ Email forensics.
Answer: The study of the source and content of email as evidence, including
the identification of the sender, recipient, date, time, and origination location
of an email message.
◍ XRY.
Answer: Tool for breaking an iPhone passcode.
◍ Data consistency.
Answer: The act of ensuring the data that is extracted is consistent.
◍ Logical damage.
Answer: Damage to how the data is stored—for example, file system
corruption.
◍ 18 USC 1030 Fraud and Related Activity in Connection with Computers.
Answer: This is one of the most widely used laws in hacking cases. It covers
a wide range of crimes involving illicit access of any computer.
◍ 18 USC 1020 Fraud and Related Activity in Connection with Access
Devices.
Answer: This is closely related to 1030 but covers access devices (such as
routers).
◍ Which law or guideline lists the four states a mobile device can be in when
data is extracted from it?.
Answer: NIST SP 800-72 Guidelines
◍ Logical imaging.
, Answer: Use of the target system's file system to copy data to an image for
analysis.
◍ Three-way handshake.
Answer: The process of connecting to a server that involves three packets
being exchanged.
◍ A forensic investigator wants to image an older BlackBerry smartphone
running OS 7.0. Which tool should the investigator use?.
Answer: BlackBerry Desktop Manager
◍ The chief information officer of an accounting firm believes sensitive data is
being exposed on the local network. Which tool should the IT staff use to
gather digital evidence about this security vulnerability?.
Answer: Sniffer
◍ Permanent denial of service (PDoS).
Answer: an attack that damages the system so badly the machine needs a full
reinstall of its OS and potentially even new hardware.
◍ What should a forensic investigator use to gather the most reliable routing
information for tracking an email message?.
Answer: Email header
◍ BASH shell.
Answer: The command prompt in Mac OS, can execute Linux commands.
◍ A computer involved in a crime is infected with malware. The computer is
on and connected to the company's network. The forensic investigator
arrives at the scene. Which action should be the investigator's first step?.
Answer: Unplug the computer's Ethernet cable
◍ Moore's law.
Answer: The observation by Gordon Moore of Intel Corporation that
capacity would double and price would be cut in half roughly every 18 to 24
months for products based on computer chips and related technology.
◍ Brute-force attack.
, Answer: An attack in which the attacker tries to decrypt a message by
simply applying every possible key in the keyspace.
◍ Which tools can do a check for steganography?.
Answer: Forensic Toolkit (FTK) and EnCase both check for steganography,
and FTK has an entire image detection engine devoted to this task.
◍ How do forensic specialists show that digital evidence was handled in a
protected, secure manner during the process of collecting and analyzing the
evidence?.
Answer: Chain of custody
◍ Polymorphic virus.
Answer: literally changes its form from time to time to avoid detection by
antivirus software. A more advanced form of this is called the Metamorphic
virus; it can completely rewrite itself.
◍ Slurred image.
Answer: The result of acquiring a file as it is being updated.
◍ Personal unlocking code (PUK).
Answer: A number for unlocking a cell phone.
◍ Common Forensic Software Programs.
Answer: EnCase from Guidance SoftwareForensic Toolkit (FTK) from
AccessDataSleuth KitAutopsyDisk Investigator
◍ Data Doctor.
Answer: Recovers all Inbox and Outbox data and all contacts data, and has
an easy-to-use interface.
◍ Host protected area (HPA).
Answer: This was designed as an area where computer vendors could store
data that is protected from user activities and operating system utilities, such
as delete and format. To hide data in the this area, a person would need to
write a program to access it and write the data.
◍ Internet Message Access Protocol (IMAP).
, Answer: A protocol used to receive email that works on port 143.
◍ Both magnetic and solid-state drives include a few features that are
important for forensics:.
Answer: Host protected area (HPA)Master boot record (MBR)Volume
slackUnallocated spaceGood blocks marked as badFile slack
◍ A foreign government is communicating with its agents in the U.S. by
hiding text messages in popular American songs, which are uploaded to the
web. Which steganographic tool can be used to do this?.
Answer: MP3Stego
◍ Physical imaging.
Answer: Making a physical copy of a disk.
◍ DFRWS Framework The Digital Forensic Research Workshop (DFRWS).
Answer: Identification Preservation Collection Examination Analysis
Presentation
◍ Memory-resident virus.
Answer: installs itself and then remains in RAM from the time the computer
is booted up to when it is shut down.
◍ Event-Based Digital Forensics Investigation Framework.
Answer: Readiness phase - contains the Operations Readiness subphase:
training people and testing investigation tools, and the Infrastructure
Readiness subphase: configuring the equipmentDeployment phase- includes
the Detection and Notification subphase: someone detects an incident and
alerts investigators, and the Confirmation and Authorization subphase:
investigators receive authorization to conduct the investigationPhysical
Crime Scene Investigation phase Digital Crime Scene Investigation phase
Presentation phase
◍ A cyber security organization has issued a warning about a cybercriminal
who is using a known vulnerability to attack unpatched corporate Macintosh
systems. A network administrator decides to examine the software updates
logs on a Macintosh system to ensure the system has been patched. Which
