WGU D431 FORENSICS LATEST UPDATED QUESTIONS
AND ANSWERS SURE A+
✔✔Life span - ✔✔A term that refers to how long data will last. The term is related to
volatility. More volatile data tends to have a shorter life span.
✔✔LILO (Linux Loader) - ✔✔One of the Linux boot loaders.
✔✔Live system forensics - ✔✔The process of searching memory in real time, typically
for working with compromised hosts or to identify system abuse.
✔✔Locard's principle of transference - ✔✔The forensics principle that states you cannot
interact with an environment without leaving some trace.
✔✔Logic bomb - ✔✔Malware that executes its damage when a specific condition is
met.
✔✔Logical analysis - ✔✔Analysis involving using the native operating system, on the
evidence disk or a forensic duplicate, to peruse the data.
✔✔Logical damage - ✔✔Damage to how the data is stored—for example, file system
corruption.
✔✔Logical imaging - ✔✔Use of the target system's file system to copy data to an image
for analysis.
✔✔Long Term Evolution (LTE) - ✔✔A standard for wireless communication of high-
speed data for mobile devices. This is what is commonly called 4G.
✔✔Low-level format - ✔✔Creation of the structure of sectors, tracks, and clusters in a
drive.
✔✔Master boot record (MBR) - ✔✔The record on the hard drive partition used to initiate
booting that partition.
✔✔Maximum tolerable downtime (MTD) - ✔✔The length of time a system can be down
before the business cannot recover.
✔✔Mean time before failure (MTBF) - ✔✔The average length of time before a given
piece of equipment will fail through normal use.
✔✔Mean time to failure (MTTF) - ✔✔How long, on average, before a given piece of
equipment will fail through normal use.
,✔✔Mean time to repair (MTTR) - ✔✔The average time needed to repair a given piece
of equipment.
✔✔Memory cell - ✔✔The fundamental building block of memory.
✔✔Metadata - ✔✔Data about the data, including information about when a file or
directory was created, when it was last modified, and so forth.
✔✔Mobile switching center (MSC) - ✔✔A switching system for a cellular network.
✔✔Moore's law - ✔✔The observation by Gordon Moore of Intel Corporation that
capacity would double and price would be cut in half roughly every 18 to 24 months for
products based on computer chips and related technology.
✔✔Multiple-input multiple-output (MIMO) - ✔✔The wireless technology that uses
multiple antennas to coherently resolve more information than is possible using a single
antenna.
✔✔Network forensics - ✔✔The process of examining network traffic, including
transaction logs and real-time monitoring.
✔✔Packets - ✔✔Chunks of data sent across a network.
✔✔Page - ✔✔A data structure that maps virtual addresses to physical addresses.
✔✔Payload - ✔✔The data to be covertly communicated. In other words, it is the
message you want to hide.
✔✔Permanent denial of service (PDoS) - ✔✔an attack that damages the system so
badly the machine needs a full reinstall of its OS and potentially even new hardware.
✔✔Personal identification number (PIN) - ✔✔An ID number for a cell phone user.
✔✔Personal unlocking code (PUK) - ✔✔A number for unlocking a cell phone.
✔✔Physical analysis - ✔✔Offline analysis conducted on an evidence disk or forensic
duplicate after booting from a CD or another system.
✔✔Physical damage - ✔✔Damage to actual hard drive parts; for example, a damaged
platter or spindle.
✔✔Physical imaging - ✔✔Making a physical copy of a disk.
, ✔✔Post Office Protocol version 3 (POP3) - ✔✔A protocol used to receive email that
works on port 110.
✔✔Power-on self-test (POST) - ✔✔A brief hardware test the BIOS performs upon boot-
up.
✔✔Probative value - ✔✔The value of evidence in helping determine the facts in a case.
✔✔Protected computer - ✔✔Any computer at a financial institution of any kind or a
government agency.
✔✔Rainbow table - ✔✔Type of password crackers that work with precalculated hashes
off all passwords available within a certain character space.
✔✔Real evidence - ✔✔Physical objects that can be touched, held, or directly observed,
such as a laptop with a suspect's fingerprints on it or a handwritten note.
✔✔Recover time objective (RTO) - ✔✔The time that the system is expected to be back
up. This must be less than MTD.
✔✔Recovery point objective (RPO) - ✔✔The amount of work that might need to be
redone, or data lost.
✔✔Routing table - ✔✔A table used with routers to track what IP addresses are
connected to ports on the router.
✔✔Rules of evidence - ✔✔Rules that govern whether, when, how, and why proof of a
legal case can be placed before a judge or jury.
✔✔Scrubber - ✔✔Software that cleans unallocated space. Also called a sweeper.
✔✔Simple Mail Transfer Protocol (SMTP) - ✔✔A protocol used to send email that works
on port 25.
✔✔Slack space - ✔✔The unused space between the logical end of file and the physical
end of file. It is also called file slack.
✔✔Slurred image - ✔✔The result of acquiring a file as it is being updated.
✔✔Sniffer - ✔✔Computer software or hardware that can intercept and log traffic passing
over a digital network.
✔✔Social engineering - ✔✔Nontechnical means of obtaining information you would not
normally have access to.
AND ANSWERS SURE A+
✔✔Life span - ✔✔A term that refers to how long data will last. The term is related to
volatility. More volatile data tends to have a shorter life span.
✔✔LILO (Linux Loader) - ✔✔One of the Linux boot loaders.
✔✔Live system forensics - ✔✔The process of searching memory in real time, typically
for working with compromised hosts or to identify system abuse.
✔✔Locard's principle of transference - ✔✔The forensics principle that states you cannot
interact with an environment without leaving some trace.
✔✔Logic bomb - ✔✔Malware that executes its damage when a specific condition is
met.
✔✔Logical analysis - ✔✔Analysis involving using the native operating system, on the
evidence disk or a forensic duplicate, to peruse the data.
✔✔Logical damage - ✔✔Damage to how the data is stored—for example, file system
corruption.
✔✔Logical imaging - ✔✔Use of the target system's file system to copy data to an image
for analysis.
✔✔Long Term Evolution (LTE) - ✔✔A standard for wireless communication of high-
speed data for mobile devices. This is what is commonly called 4G.
✔✔Low-level format - ✔✔Creation of the structure of sectors, tracks, and clusters in a
drive.
✔✔Master boot record (MBR) - ✔✔The record on the hard drive partition used to initiate
booting that partition.
✔✔Maximum tolerable downtime (MTD) - ✔✔The length of time a system can be down
before the business cannot recover.
✔✔Mean time before failure (MTBF) - ✔✔The average length of time before a given
piece of equipment will fail through normal use.
✔✔Mean time to failure (MTTF) - ✔✔How long, on average, before a given piece of
equipment will fail through normal use.
,✔✔Mean time to repair (MTTR) - ✔✔The average time needed to repair a given piece
of equipment.
✔✔Memory cell - ✔✔The fundamental building block of memory.
✔✔Metadata - ✔✔Data about the data, including information about when a file or
directory was created, when it was last modified, and so forth.
✔✔Mobile switching center (MSC) - ✔✔A switching system for a cellular network.
✔✔Moore's law - ✔✔The observation by Gordon Moore of Intel Corporation that
capacity would double and price would be cut in half roughly every 18 to 24 months for
products based on computer chips and related technology.
✔✔Multiple-input multiple-output (MIMO) - ✔✔The wireless technology that uses
multiple antennas to coherently resolve more information than is possible using a single
antenna.
✔✔Network forensics - ✔✔The process of examining network traffic, including
transaction logs and real-time monitoring.
✔✔Packets - ✔✔Chunks of data sent across a network.
✔✔Page - ✔✔A data structure that maps virtual addresses to physical addresses.
✔✔Payload - ✔✔The data to be covertly communicated. In other words, it is the
message you want to hide.
✔✔Permanent denial of service (PDoS) - ✔✔an attack that damages the system so
badly the machine needs a full reinstall of its OS and potentially even new hardware.
✔✔Personal identification number (PIN) - ✔✔An ID number for a cell phone user.
✔✔Personal unlocking code (PUK) - ✔✔A number for unlocking a cell phone.
✔✔Physical analysis - ✔✔Offline analysis conducted on an evidence disk or forensic
duplicate after booting from a CD or another system.
✔✔Physical damage - ✔✔Damage to actual hard drive parts; for example, a damaged
platter or spindle.
✔✔Physical imaging - ✔✔Making a physical copy of a disk.
, ✔✔Post Office Protocol version 3 (POP3) - ✔✔A protocol used to receive email that
works on port 110.
✔✔Power-on self-test (POST) - ✔✔A brief hardware test the BIOS performs upon boot-
up.
✔✔Probative value - ✔✔The value of evidence in helping determine the facts in a case.
✔✔Protected computer - ✔✔Any computer at a financial institution of any kind or a
government agency.
✔✔Rainbow table - ✔✔Type of password crackers that work with precalculated hashes
off all passwords available within a certain character space.
✔✔Real evidence - ✔✔Physical objects that can be touched, held, or directly observed,
such as a laptop with a suspect's fingerprints on it or a handwritten note.
✔✔Recover time objective (RTO) - ✔✔The time that the system is expected to be back
up. This must be less than MTD.
✔✔Recovery point objective (RPO) - ✔✔The amount of work that might need to be
redone, or data lost.
✔✔Routing table - ✔✔A table used with routers to track what IP addresses are
connected to ports on the router.
✔✔Rules of evidence - ✔✔Rules that govern whether, when, how, and why proof of a
legal case can be placed before a judge or jury.
✔✔Scrubber - ✔✔Software that cleans unallocated space. Also called a sweeper.
✔✔Simple Mail Transfer Protocol (SMTP) - ✔✔A protocol used to send email that works
on port 25.
✔✔Slack space - ✔✔The unused space between the logical end of file and the physical
end of file. It is also called file slack.
✔✔Slurred image - ✔✔The result of acquiring a file as it is being updated.
✔✔Sniffer - ✔✔Computer software or hardware that can intercept and log traffic passing
over a digital network.
✔✔Social engineering - ✔✔Nontechnical means of obtaining information you would not
normally have access to.
