WGU D829 Digital Forensics Complete Incident
Report | Unauthorized Activity Analysis 100% correct
& verified 2026
Pass your Western Governors University performance assessment on the first attempt
with this fully completed and verified D829 Digital Forensics Incident Report. This high-
yield document provides a comprehensive unauthorized activity analysis, featuring step-
by-step forensic investigation methodologies, evidence chain-of-custody documentation,
and critical remediation recommendations. It is an indispensable resource for
cybersecurity and digital forensics students looking to understand report structures,
align with grading rubrics, and secure an A+ pass.
Question #1
A security analyst is implementing a defense-in-depth strategy. Which of
the following combinations BEST represents this approach?
A. Firewall only at the network perimeter
B. A single antivirus solution on all workstations
C. Network firewall, host-based IDS, encryption, and user training
D. Biometric access control without password policies
Correct Answer: C
Rationale: Defense-in-depth uses multiple layers of security (network, host,
physical, administrative). A firewall alone (A) is a single layer. Antivirus alone
(B) is insufficient. Biometrics without passwords (D) removes a critical layer.
Question #2
Which of the following is the PRIMARY goal of the CIA triad in information
security?
A. Confidentiality, Integrity, and Availability
B. Cost, Integration, and Automation
,C. Compliance, Inspection, and Auditing
D. Control, Implementation, and Assessment
Correct Answer: A
Rationale: The CIA triad is the foundational model: Confidentiality (secrecy),
Integrity (accuracy), and Availability (accessibility). Options B, C, and D are
not the standard security triad.
Question #3
A company wants to ensure that employees can only access data necessary
for their job roles. This is an example of:
A. Separation of duties
B. Mandatory vacation
C. Principle of least privilege
D. Defense in depth
Correct Answer: C
Rationale: The principle of least privilege restricts user access rights to the
minimum needed to perform their job. Separation of duties (A) divides critical
tasks among people to prevent fraud.
Question #4
Which of the following is a type of social engineering attack where the
attacker pretends to be an IT support technician asking for passwords over
the phone?
A. Phishing
B. Spear phishing
C. Vishing
D. Smishing
,Correct Answer: C
Rationale: Vishing (voice phishing) uses telephone calls to trick victims.
Phishing (A) is email-based. Spear phishing (B) targets specific individuals.
Smishing (D) uses SMS/text messages.
Question #5
A malicious program requires a user to execute an infected attachment to
spread. This type of malware is classified as:
A. Worm
B. Virus
C. Trojan
D. Ransomware
Correct Answer: B
Rationale: A virus requires user action (e.g., opening an attachment) to
execute and spread. A worm (A) spreads autonomously without user
interaction. A Trojan (C) disguises itself as legitimate software.
Question #6
Which of the following is a symmetric encryption algorithm?
A. RSA
B. AES
C. ECC
D. Diffie-Hellman
Correct Answer: B
Rationale: AES (Advanced Encryption Standard) is a symmetric algorithm
using the same key for encryption and decryption. RSA (A), ECC (C), and
Diffie-Hellman (D) are asymmetric (public-key) algorithms.
, Question #7
In a PKI (Public Key Infrastructure), which component is responsible for
issuing and revoking digital certificates?
A. RA (Registration Authority)
B. CA (Certificate Authority)
C. CRL (Certificate Revocation List)
D. OCSP (Online Certificate Status Protocol)
Correct Answer: B
Rationale: The Certificate Authority (CA) is the trusted entity that issues,
manages, and revokes digital certificates. The RA (A) verifies identity but does
not issue certificates. CRL (C) and OCSP (D) are methods to check revocation
status.
Question #8
A security policy that requires users to change their passwords every 60
days and use a mix of uppercase, lowercase, numbers, and symbols is
enforcing:
A. Password complexity and aging
B. Single sign-on
C. Biometric authentication
D. Multifactor authentication
Correct Answer: A
Rationale: Complexity rules (character mix) and aging (expiration) are
password policy elements. Single sign-on (B) is about using one credential for
multiple systems. Biometrics (C) are physical traits.
Report | Unauthorized Activity Analysis 100% correct
& verified 2026
Pass your Western Governors University performance assessment on the first attempt
with this fully completed and verified D829 Digital Forensics Incident Report. This high-
yield document provides a comprehensive unauthorized activity analysis, featuring step-
by-step forensic investigation methodologies, evidence chain-of-custody documentation,
and critical remediation recommendations. It is an indispensable resource for
cybersecurity and digital forensics students looking to understand report structures,
align with grading rubrics, and secure an A+ pass.
Question #1
A security analyst is implementing a defense-in-depth strategy. Which of
the following combinations BEST represents this approach?
A. Firewall only at the network perimeter
B. A single antivirus solution on all workstations
C. Network firewall, host-based IDS, encryption, and user training
D. Biometric access control without password policies
Correct Answer: C
Rationale: Defense-in-depth uses multiple layers of security (network, host,
physical, administrative). A firewall alone (A) is a single layer. Antivirus alone
(B) is insufficient. Biometrics without passwords (D) removes a critical layer.
Question #2
Which of the following is the PRIMARY goal of the CIA triad in information
security?
A. Confidentiality, Integrity, and Availability
B. Cost, Integration, and Automation
,C. Compliance, Inspection, and Auditing
D. Control, Implementation, and Assessment
Correct Answer: A
Rationale: The CIA triad is the foundational model: Confidentiality (secrecy),
Integrity (accuracy), and Availability (accessibility). Options B, C, and D are
not the standard security triad.
Question #3
A company wants to ensure that employees can only access data necessary
for their job roles. This is an example of:
A. Separation of duties
B. Mandatory vacation
C. Principle of least privilege
D. Defense in depth
Correct Answer: C
Rationale: The principle of least privilege restricts user access rights to the
minimum needed to perform their job. Separation of duties (A) divides critical
tasks among people to prevent fraud.
Question #4
Which of the following is a type of social engineering attack where the
attacker pretends to be an IT support technician asking for passwords over
the phone?
A. Phishing
B. Spear phishing
C. Vishing
D. Smishing
,Correct Answer: C
Rationale: Vishing (voice phishing) uses telephone calls to trick victims.
Phishing (A) is email-based. Spear phishing (B) targets specific individuals.
Smishing (D) uses SMS/text messages.
Question #5
A malicious program requires a user to execute an infected attachment to
spread. This type of malware is classified as:
A. Worm
B. Virus
C. Trojan
D. Ransomware
Correct Answer: B
Rationale: A virus requires user action (e.g., opening an attachment) to
execute and spread. A worm (A) spreads autonomously without user
interaction. A Trojan (C) disguises itself as legitimate software.
Question #6
Which of the following is a symmetric encryption algorithm?
A. RSA
B. AES
C. ECC
D. Diffie-Hellman
Correct Answer: B
Rationale: AES (Advanced Encryption Standard) is a symmetric algorithm
using the same key for encryption and decryption. RSA (A), ECC (C), and
Diffie-Hellman (D) are asymmetric (public-key) algorithms.
, Question #7
In a PKI (Public Key Infrastructure), which component is responsible for
issuing and revoking digital certificates?
A. RA (Registration Authority)
B. CA (Certificate Authority)
C. CRL (Certificate Revocation List)
D. OCSP (Online Certificate Status Protocol)
Correct Answer: B
Rationale: The Certificate Authority (CA) is the trusted entity that issues,
manages, and revokes digital certificates. The RA (A) verifies identity but does
not issue certificates. CRL (C) and OCSP (D) are methods to check revocation
status.
Question #8
A security policy that requires users to change their passwords every 60
days and use a mix of uppercase, lowercase, numbers, and symbols is
enforcing:
A. Password complexity and aging
B. Single sign-on
C. Biometric authentication
D. Multifactor authentication
Correct Answer: A
Rationale: Complexity rules (character mix) and aging (expiration) are
password policy elements. Single sign-on (B) is about using one credential for
multiple systems. Biometrics (C) are physical traits.
