WGU C702 FORENSICS AND NETWORK INTRUSION EXAM
200 ACTUAL QUESTIONS AND CORRECT ANSWERS
ALREADY GRADED A+ LATEST 2026
WGU C702 Forensics and Network Intrusion is a graduate-level course in
Western Governors University's cybersecurity master's program, focusing on
digital forensics and incident response. The curriculum covers the complete
investigative lifecycle, from first responder procedures and evidence
preservation to network intrusion analysis, operating system forensics, mobile
device examination, and legal considerations including the Fourth
Amendment, chain of custody, and expert testimony. Students learn to
identify, collect, and analyze digital evidence from computers, networks,
mobile devices, and databases. The final objective assessment is a rigorous
proctored exam testing applied knowledge of forensic tools, investigation
methodologies, and legal frameworks essential for cybersecurity professionals.
1. What is the primary goal of computer forensics?
A) To recover deleted files for personal use
B) To identify, preserve, analyze, and present digital evidence in a legally
admissible manner
C) To monitor network traffic for intrusions
D) To install security software on compromised systems
Correct Answer: B
Rationale: The primary goal of computer forensics is to perform a structured
investigation while maintaining a documented chain of evidence to find out exactly
what happened on a computing device and who was responsible, ensuring findings
are admissible in court .
2. Which of the following is NOT one of the four main aspects of organizational
security?
A) IT Security
B) Physical Security
C) Marketing Security
D) Legal Security
Correct Answer: C
,Rationale: The four main aspects of organizational security are IT Security,
Physical Security, Financial Security, and Legal Security. Marketing security is not
a recognized main aspect of organizational security .
3. What is the first step a forensic investigator must take upon arriving at a crime
scene?
A) Begin imaging hard drives immediately
B) Secure and isolate the scene to prevent contamination of evidence
C) Interview all witnesses
D) Power on all computers to check their status
Correct Answer: B
Rationale: The first responder is responsible for protecting, integrating, and
preserving evidence. Securing and isolating the scene prevents contamination and
ensures evidence integrity .
4. According to Locard's Exchange Principle, what occurs when someone enters a
crime scene?
A) Nothing is transferred between the person and the scene
B) The person takes something from the scene and leaves something behind
C) Only trace evidence is transferred, not digital evidence
D) The scene remains unchanged by the person's presence
Correct Answer: B
Rationale: Locard's Exchange Principle states that anyone entering a crime scene
takes something of the scene with them and leaves something of themselves
behind. This applies to both physical and digital evidence .
5. Which of the following is a characteristic of volatile data?
A) It is permanently stored on a hard drive
B) It requires constant power supply and is lost when power is interrupted
C) It cannot be used as evidence in court
D) It is always encrypted
Correct Answer: B
Rationale: Volatile data is temporary information on a device that requires a
constant power supply and is deleted if the power supply is interrupted. Examples
include CPU registers, RAM, and cache memory .
6. What is non-volatile data in digital forensics?
A) Temporary information lost when power is removed
B) Secondary storage of data that is long-term and persistent
C) Data stored in RAM only
,D) Data that cannot be used as evidence
Correct Answer: B
Rationale: Non-volatile data refers to secondary storage of data that is long-term
and persistent. It is permanently stored on secondary storage devices, such as hard
disks and memory cards .
7. What is the correct order of volatility (OOV) for digital evidence from most
volatile to least?
A) Hard drive, RAM, CPU cache, network connections
B) CPU registers and cache, RAM, temporary file systems, disk storage
C) Disk storage, temporary file systems, RAM, CPU cache
D) Network connections, disk storage, CPU cache, RAM
Correct Answer: B
Rationale: The order of volatility lists digital evidence from most volatile to least:
CPU Registers & Cache, Routing Table, ARP Cache, Process Table, Kernel
Statistics, Memory (RAM), Temporary File Systems, Disk, Remote Logging and
Monitoring Data, Physical Configuration and Network Topology, Archival Media .
8. What is a write blocker and why is it used in forensics?
A) A tool that speeds up data transfer
B) A hardware or software tool that prevents any write commands from being sent
to a storage device, preserving the original evidence
C) A device that encrypts data for secure storage
D) A tool that compresses forensic images for easier storage
Correct Answer: B
Rationale: A write blocker is a hardware or software tool that prevents any write
commands from being sent to a storage device, thus preserving the original
evidence and its integrity. This is critical for ensuring evidence is admissible in
court .
9. What is a bit-stream copy in digital forensics?
A) A compressed backup of selected files
B) A logical copy of directory structures only
C) A bit-by-bit copy of the original storage medium
D) A screenshot of file contents
Correct Answer: C
Rationale: A bit-stream copy is an exact, bit-for-bit duplicate of the original
storage medium, capturing all data including deleted files, slack space, and
unallocated clusters .
, 10. Why is creating a forensic image important?
A) It saves storage space
B) It ensures an exact, unaltered copy of the original media for analysis, leaving
the original pristine
C) It makes files easier to search
D) It automatically decrypts protected files
Correct Answer: B
Rationale: Forensic imaging creates an exact replica for analysis, preserving the
original evidence and allowing verification through hash matching .
11. What is a hash value (e.g., MD5, SHA-256) used for in forensics?
A) To encrypt evidence files
B) To compress data for storage
C) To verify the integrity of data by comparing hash values
D) To password-protect evidence
Correct Answer: C
Rationale: Hash values are used to verify the integrity of a forensic image. If the
hash of the original and the copy match, the data has not been altered, proving
integrity .
12. What is the difference between active data and ambient data?
A) Active data is encrypted; ambient data is plain text
B) Active data is readily visible to the user; ambient data includes deleted files,
slack space, and unallocated clusters
C) Active data is on servers; ambient data is on workstations
D) There is no difference
Correct Answer: B
Rationale: Active data is readily visible to the user and the operating system (e.g.,
files in a directory). Ambient data (or latent data) is not immediately accessible and
includes deleted files, slack space, and unallocated clusters .
13. Define "slack space" in digital forensics.
A) The space between the end of a file and the end of the last cluster allocated to
that file
B) The unused space on a hard drive
C) The space reserved for system files
D) The space allocated for virtual memory
Correct Answer: A
200 ACTUAL QUESTIONS AND CORRECT ANSWERS
ALREADY GRADED A+ LATEST 2026
WGU C702 Forensics and Network Intrusion is a graduate-level course in
Western Governors University's cybersecurity master's program, focusing on
digital forensics and incident response. The curriculum covers the complete
investigative lifecycle, from first responder procedures and evidence
preservation to network intrusion analysis, operating system forensics, mobile
device examination, and legal considerations including the Fourth
Amendment, chain of custody, and expert testimony. Students learn to
identify, collect, and analyze digital evidence from computers, networks,
mobile devices, and databases. The final objective assessment is a rigorous
proctored exam testing applied knowledge of forensic tools, investigation
methodologies, and legal frameworks essential for cybersecurity professionals.
1. What is the primary goal of computer forensics?
A) To recover deleted files for personal use
B) To identify, preserve, analyze, and present digital evidence in a legally
admissible manner
C) To monitor network traffic for intrusions
D) To install security software on compromised systems
Correct Answer: B
Rationale: The primary goal of computer forensics is to perform a structured
investigation while maintaining a documented chain of evidence to find out exactly
what happened on a computing device and who was responsible, ensuring findings
are admissible in court .
2. Which of the following is NOT one of the four main aspects of organizational
security?
A) IT Security
B) Physical Security
C) Marketing Security
D) Legal Security
Correct Answer: C
,Rationale: The four main aspects of organizational security are IT Security,
Physical Security, Financial Security, and Legal Security. Marketing security is not
a recognized main aspect of organizational security .
3. What is the first step a forensic investigator must take upon arriving at a crime
scene?
A) Begin imaging hard drives immediately
B) Secure and isolate the scene to prevent contamination of evidence
C) Interview all witnesses
D) Power on all computers to check their status
Correct Answer: B
Rationale: The first responder is responsible for protecting, integrating, and
preserving evidence. Securing and isolating the scene prevents contamination and
ensures evidence integrity .
4. According to Locard's Exchange Principle, what occurs when someone enters a
crime scene?
A) Nothing is transferred between the person and the scene
B) The person takes something from the scene and leaves something behind
C) Only trace evidence is transferred, not digital evidence
D) The scene remains unchanged by the person's presence
Correct Answer: B
Rationale: Locard's Exchange Principle states that anyone entering a crime scene
takes something of the scene with them and leaves something of themselves
behind. This applies to both physical and digital evidence .
5. Which of the following is a characteristic of volatile data?
A) It is permanently stored on a hard drive
B) It requires constant power supply and is lost when power is interrupted
C) It cannot be used as evidence in court
D) It is always encrypted
Correct Answer: B
Rationale: Volatile data is temporary information on a device that requires a
constant power supply and is deleted if the power supply is interrupted. Examples
include CPU registers, RAM, and cache memory .
6. What is non-volatile data in digital forensics?
A) Temporary information lost when power is removed
B) Secondary storage of data that is long-term and persistent
C) Data stored in RAM only
,D) Data that cannot be used as evidence
Correct Answer: B
Rationale: Non-volatile data refers to secondary storage of data that is long-term
and persistent. It is permanently stored on secondary storage devices, such as hard
disks and memory cards .
7. What is the correct order of volatility (OOV) for digital evidence from most
volatile to least?
A) Hard drive, RAM, CPU cache, network connections
B) CPU registers and cache, RAM, temporary file systems, disk storage
C) Disk storage, temporary file systems, RAM, CPU cache
D) Network connections, disk storage, CPU cache, RAM
Correct Answer: B
Rationale: The order of volatility lists digital evidence from most volatile to least:
CPU Registers & Cache, Routing Table, ARP Cache, Process Table, Kernel
Statistics, Memory (RAM), Temporary File Systems, Disk, Remote Logging and
Monitoring Data, Physical Configuration and Network Topology, Archival Media .
8. What is a write blocker and why is it used in forensics?
A) A tool that speeds up data transfer
B) A hardware or software tool that prevents any write commands from being sent
to a storage device, preserving the original evidence
C) A device that encrypts data for secure storage
D) A tool that compresses forensic images for easier storage
Correct Answer: B
Rationale: A write blocker is a hardware or software tool that prevents any write
commands from being sent to a storage device, thus preserving the original
evidence and its integrity. This is critical for ensuring evidence is admissible in
court .
9. What is a bit-stream copy in digital forensics?
A) A compressed backup of selected files
B) A logical copy of directory structures only
C) A bit-by-bit copy of the original storage medium
D) A screenshot of file contents
Correct Answer: C
Rationale: A bit-stream copy is an exact, bit-for-bit duplicate of the original
storage medium, capturing all data including deleted files, slack space, and
unallocated clusters .
, 10. Why is creating a forensic image important?
A) It saves storage space
B) It ensures an exact, unaltered copy of the original media for analysis, leaving
the original pristine
C) It makes files easier to search
D) It automatically decrypts protected files
Correct Answer: B
Rationale: Forensic imaging creates an exact replica for analysis, preserving the
original evidence and allowing verification through hash matching .
11. What is a hash value (e.g., MD5, SHA-256) used for in forensics?
A) To encrypt evidence files
B) To compress data for storage
C) To verify the integrity of data by comparing hash values
D) To password-protect evidence
Correct Answer: C
Rationale: Hash values are used to verify the integrity of a forensic image. If the
hash of the original and the copy match, the data has not been altered, proving
integrity .
12. What is the difference between active data and ambient data?
A) Active data is encrypted; ambient data is plain text
B) Active data is readily visible to the user; ambient data includes deleted files,
slack space, and unallocated clusters
C) Active data is on servers; ambient data is on workstations
D) There is no difference
Correct Answer: B
Rationale: Active data is readily visible to the user and the operating system (e.g.,
files in a directory). Ambient data (or latent data) is not immediately accessible and
includes deleted files, slack space, and unallocated clusters .
13. Define "slack space" in digital forensics.
A) The space between the end of a file and the end of the last cluster allocated to
that file
B) The unused space on a hard drive
C) The space reserved for system files
D) The space allocated for virtual memory
Correct Answer: A
