WGU D431 DIGITAL FORENSICS IN
CYBERSECURITY EXAM 2026 CERTIFICATION
INVESTIGATION TEST PAPER QUESTIONS AND
SOLUTIONS GRADED A+
◉ computer forensics. Answer: is considered to be the use of
analytical and investigative techniques to identify, collect, examine
and preserve evidence/information which is magnetically stored or
encoded.
◉ Collecting data. Answer: Before you can do any forensic analysis
or examination, you have to gather the evidence. There are very
specific procedures for properly gather evidence.
◉ Analyzing. Answer: is one of the most time-consuming parts of a
forensic investigation, and it can be the most challenging. It is
solving a complex puzzle—putting together the data you have and
finding out what sort of picture is revealed.
◉ Presenting. Answer: Once you have finished your investigation,
done your analysis, and obeyed all the rules and guidelines, you still
need to display the data.
,◉ Expert Report. Answer: is a formal document that lists what tests
you conducted, what you found, and your conclusions.
◉ curriculum vitae (CV). Answer: is like a resume, only much more
thorough and specific to your work experience as a forensic
investigator.
◉ Expert Testimony. Answer: you will testify as an expert witness—
that is, on the basis of scientific or technical knowledge you have
that is relevant to a case, rather than on the basis of direct personal
experience.
◉ Rule 703: Bases of an expert. Answer: RULE: An expert may base
an opinion on facts or data in the case that the expert has been made
aware of or personally observed. If experts in the particular field
would reasonably rely on those kinds of facts or data in forming an
opinion on the subject, they need not be admissible for the opinion
to be admitted. But if the facts or data would otherwise be
inadmissible, the proponent of the opinion may disclose them to the
jury only if their probative value in helping the jury evaluate the
opinion substantially outweighs their prejudicial effect.
◉ Rule 704: Opinion on ultimate issue. Answer: RULE: an expert
witness can, in many cases, offer an opinion as to the ultimate issue
in a case.
,◉ Rule 705: Disclosing the facts or data underlying an expert.
Answer: RULE: Unless the court orders otherwise, an expert may
state an opinion—and give the reasons for it—without first
testifying to the underlying facts or data.
◉ Rule 706: Court-appointed expert witness. Answer: This rule
covers the appointment of neutral experts used to advise the court.
Such experts are working for neither the plaintiff nor the defendant;
they work for the court.
◉ Rule 401: Test for relevant evidence. Answer: RULE: Evidence is
relevant if (a) it has any
tendency to make a fact more or less probable than it would be
without the
evidence and (b) the fact is of consequence in determining the
action.
◉ Digital Evidence. Answer: is information that has been processed
and assembled so that it is relevant to an investigation and supports
a specific finding or determination.
◉ chain of custody. Answer: is the continuity of control of evidence
that makes it possible to account for all that has happened to
evidence between its original collection and its appearance in court,
preferably unaltered.
, ◉ Real evidence. Answer: is a physical object that someone can
touch, hold, or directly observe
◉ Documentary Evidence. Answer: evidence is data stored as
written matter, on paper, or in electronic files.
◉ Testimonial evidence. Answer: is information that forensic
specialists use to support or interpret real or documentary evidence.
◉ demonstrative evidence. Answer: evidence is information that
helps explain other evidence—any other evidence
◉ Distributed Crime Scenes. Answer: networks are geographically
dispersed, crime scenes may also be geographically dispersed. This
creates practical as well as jurisdictional problems.
◉ Disk forensics. Answer: is the process of acquiring and analyzing
information stored on physical storage media, such as computer
hard drives, smartphones, GPS systems, and removable media.
◉ Email forensics. Answer: is the study of the source and content of
email as evidence.
CYBERSECURITY EXAM 2026 CERTIFICATION
INVESTIGATION TEST PAPER QUESTIONS AND
SOLUTIONS GRADED A+
◉ computer forensics. Answer: is considered to be the use of
analytical and investigative techniques to identify, collect, examine
and preserve evidence/information which is magnetically stored or
encoded.
◉ Collecting data. Answer: Before you can do any forensic analysis
or examination, you have to gather the evidence. There are very
specific procedures for properly gather evidence.
◉ Analyzing. Answer: is one of the most time-consuming parts of a
forensic investigation, and it can be the most challenging. It is
solving a complex puzzle—putting together the data you have and
finding out what sort of picture is revealed.
◉ Presenting. Answer: Once you have finished your investigation,
done your analysis, and obeyed all the rules and guidelines, you still
need to display the data.
,◉ Expert Report. Answer: is a formal document that lists what tests
you conducted, what you found, and your conclusions.
◉ curriculum vitae (CV). Answer: is like a resume, only much more
thorough and specific to your work experience as a forensic
investigator.
◉ Expert Testimony. Answer: you will testify as an expert witness—
that is, on the basis of scientific or technical knowledge you have
that is relevant to a case, rather than on the basis of direct personal
experience.
◉ Rule 703: Bases of an expert. Answer: RULE: An expert may base
an opinion on facts or data in the case that the expert has been made
aware of or personally observed. If experts in the particular field
would reasonably rely on those kinds of facts or data in forming an
opinion on the subject, they need not be admissible for the opinion
to be admitted. But if the facts or data would otherwise be
inadmissible, the proponent of the opinion may disclose them to the
jury only if their probative value in helping the jury evaluate the
opinion substantially outweighs their prejudicial effect.
◉ Rule 704: Opinion on ultimate issue. Answer: RULE: an expert
witness can, in many cases, offer an opinion as to the ultimate issue
in a case.
,◉ Rule 705: Disclosing the facts or data underlying an expert.
Answer: RULE: Unless the court orders otherwise, an expert may
state an opinion—and give the reasons for it—without first
testifying to the underlying facts or data.
◉ Rule 706: Court-appointed expert witness. Answer: This rule
covers the appointment of neutral experts used to advise the court.
Such experts are working for neither the plaintiff nor the defendant;
they work for the court.
◉ Rule 401: Test for relevant evidence. Answer: RULE: Evidence is
relevant if (a) it has any
tendency to make a fact more or less probable than it would be
without the
evidence and (b) the fact is of consequence in determining the
action.
◉ Digital Evidence. Answer: is information that has been processed
and assembled so that it is relevant to an investigation and supports
a specific finding or determination.
◉ chain of custody. Answer: is the continuity of control of evidence
that makes it possible to account for all that has happened to
evidence between its original collection and its appearance in court,
preferably unaltered.
, ◉ Real evidence. Answer: is a physical object that someone can
touch, hold, or directly observe
◉ Documentary Evidence. Answer: evidence is data stored as
written matter, on paper, or in electronic files.
◉ Testimonial evidence. Answer: is information that forensic
specialists use to support or interpret real or documentary evidence.
◉ demonstrative evidence. Answer: evidence is information that
helps explain other evidence—any other evidence
◉ Distributed Crime Scenes. Answer: networks are geographically
dispersed, crime scenes may also be geographically dispersed. This
creates practical as well as jurisdictional problems.
◉ Disk forensics. Answer: is the process of acquiring and analyzing
information stored on physical storage media, such as computer
hard drives, smartphones, GPS systems, and removable media.
◉ Email forensics. Answer: is the study of the source and content of
email as evidence.
