WGU C840 DIGITAL FORENSICS IN CYBERSECURITY EXAM ACTUAL
2026/2027 - COMPLETE QUESTIONS WITH DETAILED RATIONALES 100%
VERIFIED ANSWERS - PASS GUARANTEED - A+ GRADED
200 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Apply forensic methodologies to acquire and preserve digital evidence
2 Analyze file systems, memory, and network artifacts to reconstruct events
3 Evaluate legal and ethical issues in digital forensics
4 Synthesize forensic findings into comprehensive reports and expert testimony
5 WGU C840 Digital Forensics in Cybersecurity Exam Actual 2026
6 2027
7 Complete Questions with Detailed Rationales 100% Verified Answers
8 Pass Guaranteed
9 A+ Graded
10 Foundations of Digital Forensics and Cybersecurity
11 Applied Digital Forensics and Cybersecurity
12 Advanced Digital Forensics and Cybersecurity
13 Digital Forensics and Cybersecurity Review
Page 1
,Q1 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a Windows 10 system, which artifact would provide the most reliable evidence
of a user's recently accessed external storage device, even if the user attempted to
delete files and clear the Recycle Bin?
A. NTFS $LogFile
B. Windows Prefetch files
C. USBDeview registry keys
D. MFT (Master File Table) entries CORRECT
RATIONALE: The MFT contains records of all files and directories, including those on external
volumes, and remnants persist even after deletion. Prefetch files only track application launches,
USBDeview is not a standard artifact, and $LogFile is for metadata journaling, not direct
evidence of device access.
Q2 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
During a forensic examination of a Linux system, you discover a process that is
hidden from the standard 'ps' output. Which technique would be most effective for
identifying this hidden process?
A. Checking /proc directory entries CORRECT
B. Running 'ps -ef' with root privileges
C. Using 'lsof' to list open files
D. Examining the bash history file
RATIONALE: The /proc filesystem exposes all running processes as directories, and comparing
/proc entries with 'ps' output can reveal hidden processes. 'ps -ef' uses the same kernel
interfaces and may also be fooled by rootkits. 'lsof' is useful for open files but not for enumerating
processes. Bash history does not show running processes.
Page 2
,Q3 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a network forensic investigation, you need to correlate an HTTP request to a
specific user on a corporate network that uses NAT. Which log source would
provide the most direct evidence of the internal IP address that initiated the
request?
A. Firewall logs
B. Proxy server logs CORRECT
C. DNS server logs
D. Web server access logs
RATIONALE: Proxy server logs typically record the internal client IP address and the requested
URL, bridging the NAT gap. Firewall logs show NAT translations but not necessarily the full HTTP
request details. DNS logs only show domain resolution, and web server logs see only the public
IP after NAT.
Q4 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
A forensic image of a hard drive is acquired using a hardware write blocker. Which
of the following is the primary reason for using a hardware write blocker instead of
a software-based one?
A. It is faster and more efficient
B. It prevents any modification to the source drive at the hardware level CORRECT
C. It is cheaper than software alternatives
D. It automatically creates a cryptographic hash of the evidence
RATIONALE: Hardware write blockers operate at the bus level, ensuring that no write commands
reach the source drive, even if the operating system malfunctions. Software write blockers rely
on the OS and can be bypassed by malware. Speed, cost, and hashing are not primary
advantages.
Page 3
, Q5 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a forensic examination of a mobile device, you find a SQLite database that
appears to contain deleted chat messages. Which of the following is the most
critical step to preserve the integrity of this evidence?
A. Copying the database file to a forensic workstation
B. Creating a bit-for-bit image of the entire device CORRECT
C. Using a SQLite browser to view the database contents
D. Performing a logical extraction of the device
RATIONALE: A bit-for-bit image preserves the entire storage, including deleted data and
unallocated space, and is the gold standard for mobile forensic acquisition. Copying just the
database file may miss deleted records. Logical extraction only captures active files. Using a
SQLite browser may modify the database if not careful.
Q6 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
Which of the following scenarios would require the application of the 'plain view
doctrine' to be legally admissible?
A. An investigator discovers child pornography while searching for evidence of a murder
CORRECT
B. A forensic examiner finds evidence of credit card fraud during a routine network scan
C. A police officer sees a stolen laptop through a car window during a traffic stop
D. A system administrator monitors employee emails as part of a company policy
RATIONALE: The plain view doctrine applies when an officer is lawfully present and inadvertently
discovers evidence of a different crime. In the digital context, this often occurs during a search
authorized for one crime. The other scenarios involve either private searches or situations where
the evidence is in plain view from a lawful vantage point, but the doctrine is specifically invoked
for inadvertent discovery during a lawful search.
Page 4
2026/2027 - COMPLETE QUESTIONS WITH DETAILED RATIONALES 100%
VERIFIED ANSWERS - PASS GUARANTEED - A+ GRADED
200 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Apply forensic methodologies to acquire and preserve digital evidence
2 Analyze file systems, memory, and network artifacts to reconstruct events
3 Evaluate legal and ethical issues in digital forensics
4 Synthesize forensic findings into comprehensive reports and expert testimony
5 WGU C840 Digital Forensics in Cybersecurity Exam Actual 2026
6 2027
7 Complete Questions with Detailed Rationales 100% Verified Answers
8 Pass Guaranteed
9 A+ Graded
10 Foundations of Digital Forensics and Cybersecurity
11 Applied Digital Forensics and Cybersecurity
12 Advanced Digital Forensics and Cybersecurity
13 Digital Forensics and Cybersecurity Review
Page 1
,Q1 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a Windows 10 system, which artifact would provide the most reliable evidence
of a user's recently accessed external storage device, even if the user attempted to
delete files and clear the Recycle Bin?
A. NTFS $LogFile
B. Windows Prefetch files
C. USBDeview registry keys
D. MFT (Master File Table) entries CORRECT
RATIONALE: The MFT contains records of all files and directories, including those on external
volumes, and remnants persist even after deletion. Prefetch files only track application launches,
USBDeview is not a standard artifact, and $LogFile is for metadata journaling, not direct
evidence of device access.
Q2 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
During a forensic examination of a Linux system, you discover a process that is
hidden from the standard 'ps' output. Which technique would be most effective for
identifying this hidden process?
A. Checking /proc directory entries CORRECT
B. Running 'ps -ef' with root privileges
C. Using 'lsof' to list open files
D. Examining the bash history file
RATIONALE: The /proc filesystem exposes all running processes as directories, and comparing
/proc entries with 'ps' output can reveal hidden processes. 'ps -ef' uses the same kernel
interfaces and may also be fooled by rootkits. 'lsof' is useful for open files but not for enumerating
processes. Bash history does not show running processes.
Page 2
,Q3 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a network forensic investigation, you need to correlate an HTTP request to a
specific user on a corporate network that uses NAT. Which log source would
provide the most direct evidence of the internal IP address that initiated the
request?
A. Firewall logs
B. Proxy server logs CORRECT
C. DNS server logs
D. Web server access logs
RATIONALE: Proxy server logs typically record the internal client IP address and the requested
URL, bridging the NAT gap. Firewall logs show NAT translations but not necessarily the full HTTP
request details. DNS logs only show domain resolution, and web server logs see only the public
IP after NAT.
Q4 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
A forensic image of a hard drive is acquired using a hardware write blocker. Which
of the following is the primary reason for using a hardware write blocker instead of
a software-based one?
A. It is faster and more efficient
B. It prevents any modification to the source drive at the hardware level CORRECT
C. It is cheaper than software alternatives
D. It automatically creates a cryptographic hash of the evidence
RATIONALE: Hardware write blockers operate at the bus level, ensuring that no write commands
reach the source drive, even if the operating system malfunctions. Software write blockers rely
on the OS and can be bypassed by malware. Speed, cost, and hashing are not primary
advantages.
Page 3
, Q5 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
In a forensic examination of a mobile device, you find a SQLite database that
appears to contain deleted chat messages. Which of the following is the most
critical step to preserve the integrity of this evidence?
A. Copying the database file to a forensic workstation
B. Creating a bit-for-bit image of the entire device CORRECT
C. Using a SQLite browser to view the database contents
D. Performing a logical extraction of the device
RATIONALE: A bit-for-bit image preserves the entire storage, including deleted data and
unallocated space, and is the gold standard for mobile forensic acquisition. Copying just the
database file may miss deleted records. Logical extraction only captures active files. Using a
SQLite browser may modify the database if not careful.
Q6 APPLY FORENSIC METHODOLOGIES TO ACQUIRE AND PRESERVE DIGITAL EVIDENCE
Which of the following scenarios would require the application of the 'plain view
doctrine' to be legally admissible?
A. An investigator discovers child pornography while searching for evidence of a murder
CORRECT
B. A forensic examiner finds evidence of credit card fraud during a routine network scan
C. A police officer sees a stolen laptop through a car window during a traffic stop
D. A system administrator monitors employee emails as part of a company policy
RATIONALE: The plain view doctrine applies when an officer is lawfully present and inadvertently
discovers evidence of a different crime. In the digital context, this often occurs during a search
authorized for one crime. The other scenarios involve either private searches or situations where
the evidence is in plain view from a lawful vantage point, but the doctrine is specifically invoked
for inadvertent discovery during a lawful search.
Page 4
