WGU D431 Objective Assessment Review (Latest 2025/ 2026 Update) Digital Forensics in Cybersecurity| Qs & As| Grade A 100% Correct (Verified Answers)

WGU D431 Objective Assessment Review (Latest 2025/ 2026 Update) Digital Forensics in Cybersecurity| Qs & As| Grade A 100% Correct (Verified Answers) Q: Which method of copying digital evidence ensures proper evidence collection? A. Make the copy at the bit-level B. Copy files using drag and drop C. Make the copy using file transfer D. Copy the logical partitions Answer: A. Make the copy at the bit-level Q: Which type of storage format should be transported in a special bag to reduce electrostatic interference? A. Solid-state drives B. Optical media C. Digital audio tapes D. Magnetic media Answer: A. Solid-state drives Q: Which Windows component is responsible for reading the file and displaying the boot loader menu on Windows XP during the boot process? A. NTLDR B. NTOSKRNL C. Windows Registry D. Win32 subsystem Answer: A. NTLDR Q: The following line of code is an example of how to make a forensic copy of a suspect drive: dd if=/dev/mem of=/evidence/y1 Which operating system should be used to run this command? A. Windows B. Chrome C. BlackBerry D. Linux Answer: D. Linux Q: Which file system is supported by Mac? A. Berkeley Fast File System (FFS) B. Extended File System (Ext) C. Reiser File System (ReiserFS) D. Hierarchical File System Plus (HFS+) Answer: D. Hierarchical File System Plus (HFS+) Q: Where are local passwords stored for the Windows operating system? A. SAM file in WindowsSystem32 B. SAM file in WindowsSecurity C. In the registry key HKEY_LOCAL_MACHINESYSTEM D. In the registry key HKEY_LOCAL_MAHCINESECURITY Answer: A. SAM file in WindowsSystem32 Q: Where on a Windows system is the config folder located that contains the SAM file? A. C:WindowsSystem32 B. C:WindowsSystemResources C. C:Program Files D. C:Users Answer: A. C:WindowsSystem32 Q: What should a forensic investigator use to gather the most reliable routing information for tracking an email message? A. Email header B. Email address C. Tracert D. Netstat Answer: A. Email header Q: A forensic examiner reviews a laptop running OS X which has been compromised. The examiner wants to know if there were any mounted volumes created from USB drives.