WGU C702 QUESTIONS WITH ACCURATE ANSWERS
Computer Forensics - Accurate answers A set of methodological procedures and techniques that
help identify, gather, preserve, extract, interpret, document, and present evidence from computers in a
way that is legally admissible
Cyber Crime - Accurate answers Any illegal act involving a computing device, network, its systems,
or its applications. Both internal and external
Enterprise Theory of Investigation (ETI) - Accurate answers Methodology for investigating criminal
activity
Types of Cyber Crime - Accurate answers Civil, Criminal, Administrative
Civil Cases - Accurate answers Involve disputes between two parties. Brought for violation of
contracts and lawsuits where a guilty outcome generally results in monetary damages to the plaintiff
Criminal Cases - Accurate answers Brought by law enforcement agencies in response to a
suspected violation of law where a guilty outcome results in monetary damages, imprisonment, or both
Administrative Cases - Accurate answers An internal investigation by an organization to discover if
its employees/clients/partners are abiding by the rules or policies (Violation of company policies). Non-
criminal in nature and are related to misconduct or activities of an employee
Rules of Forensic Investigation - Accurate answers Safeguard the integrity of the evidence and
render it acceptable in a court of law. The forensic examiner must make duplicate copies of the original
evidence. The duplicate copies must be accurate replications of the originals, and the forensic examiner
must also authenticate the duplicate copies to avoid questions about the integrity of the evidence. Must
not continue with the investigation if the examination is going to be beyond his or her knowledge level
or skill level.
Cyber Crime Investigation Methodology/Steps - Accurate answers 1.Identify the computer crime
2.Collect preliminary evidence 3.Obtain court warrant dor discovery/seizure of evidence 4.Perform first
responder procedures 5.Seize evidence at the crime scene 6. Transport evidence to lab 7.Create two
bitstream copies of the evidence 8. Generate MD5 checksum of the images 9. Maintain chain of custody
10. Store original evidence in secure location 11. Analyze the image copy for evidence 12. Prepare a
forensic report 13. Submit a report to client 14. Testify in course as an expert witness
Locard's Exchange Principle - Accurate answers Anyone of anything, entering a crime scene takes
something of the scene with them and leaves something of themselves behind when they leave.
Types of Digital Data - Accurate answers Volatile Data
Non-volatile Data
Volatile Data - Accurate answers Temporary information on a device that requires a constant
power supply and is deleted if the power supply is interrupted
, Non-Volatile Data - Accurate answers Secondary storage of data. Long-term, persistent data.
Permanent data stored on secondary storage devices, such as hard disks and memory cards.
Characteristics of Digital Evidence - Accurate answers 1. Be Relevant
2. Be probative
3. Be authentic
4. Be accurate
5. Be complete
6. Be convincing
7. Be admissible
Admissible evidence - Accurate answers Evidence that can be legally and properly introduced in a
civil or criminal trial.
Evidence is relevant to the case
Authentic Evidence - Accurate answers Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy, and integrity of
the evidence
Complete Evidence - Accurate answers Evidence must either prove or disprove the fact
Reliable Evidence - Accurate answers evidence that possesses a sufficient degree of likelihood that
it is true and accurate
Evidence must be proven dependable when the evidence was extracted
Believable Evidence - Accurate answers Evidence must be presented in a clear manner and expert
opinions must be obtained where necessary
Rules of Evidence - Accurate answers Rules governing the admissibility of evidence in trial courts.
Best Evidence Rule - Accurate answers states that secondary evidence, or a copy, is inadmissible in
court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
Forensic Readiness - Accurate answers An organization's ability to make optimal use of digital
evidence in a limited period and with minimal investigation costs.
Fourth Amendment - Accurate answers Protects against unreasonable search and seizure.
Government agents may not search or seize areas or things in which a person has reasonable
expectation of privacy, without a search warrant.
Chain of Custody - Accurate answers a written record of all people who have had possession of an
item of evidence
Computer Forensics - Accurate answers A set of methodological procedures and techniques that
help identify, gather, preserve, extract, interpret, document, and present evidence from computers in a
way that is legally admissible
Cyber Crime - Accurate answers Any illegal act involving a computing device, network, its systems,
or its applications. Both internal and external
Enterprise Theory of Investigation (ETI) - Accurate answers Methodology for investigating criminal
activity
Types of Cyber Crime - Accurate answers Civil, Criminal, Administrative
Civil Cases - Accurate answers Involve disputes between two parties. Brought for violation of
contracts and lawsuits where a guilty outcome generally results in monetary damages to the plaintiff
Criminal Cases - Accurate answers Brought by law enforcement agencies in response to a
suspected violation of law where a guilty outcome results in monetary damages, imprisonment, or both
Administrative Cases - Accurate answers An internal investigation by an organization to discover if
its employees/clients/partners are abiding by the rules or policies (Violation of company policies). Non-
criminal in nature and are related to misconduct or activities of an employee
Rules of Forensic Investigation - Accurate answers Safeguard the integrity of the evidence and
render it acceptable in a court of law. The forensic examiner must make duplicate copies of the original
evidence. The duplicate copies must be accurate replications of the originals, and the forensic examiner
must also authenticate the duplicate copies to avoid questions about the integrity of the evidence. Must
not continue with the investigation if the examination is going to be beyond his or her knowledge level
or skill level.
Cyber Crime Investigation Methodology/Steps - Accurate answers 1.Identify the computer crime
2.Collect preliminary evidence 3.Obtain court warrant dor discovery/seizure of evidence 4.Perform first
responder procedures 5.Seize evidence at the crime scene 6. Transport evidence to lab 7.Create two
bitstream copies of the evidence 8. Generate MD5 checksum of the images 9. Maintain chain of custody
10. Store original evidence in secure location 11. Analyze the image copy for evidence 12. Prepare a
forensic report 13. Submit a report to client 14. Testify in course as an expert witness
Locard's Exchange Principle - Accurate answers Anyone of anything, entering a crime scene takes
something of the scene with them and leaves something of themselves behind when they leave.
Types of Digital Data - Accurate answers Volatile Data
Non-volatile Data
Volatile Data - Accurate answers Temporary information on a device that requires a constant
power supply and is deleted if the power supply is interrupted
, Non-Volatile Data - Accurate answers Secondary storage of data. Long-term, persistent data.
Permanent data stored on secondary storage devices, such as hard disks and memory cards.
Characteristics of Digital Evidence - Accurate answers 1. Be Relevant
2. Be probative
3. Be authentic
4. Be accurate
5. Be complete
6. Be convincing
7. Be admissible
Admissible evidence - Accurate answers Evidence that can be legally and properly introduced in a
civil or criminal trial.
Evidence is relevant to the case
Authentic Evidence - Accurate answers Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy, and integrity of
the evidence
Complete Evidence - Accurate answers Evidence must either prove or disprove the fact
Reliable Evidence - Accurate answers evidence that possesses a sufficient degree of likelihood that
it is true and accurate
Evidence must be proven dependable when the evidence was extracted
Believable Evidence - Accurate answers Evidence must be presented in a clear manner and expert
opinions must be obtained where necessary
Rules of Evidence - Accurate answers Rules governing the admissibility of evidence in trial courts.
Best Evidence Rule - Accurate answers states that secondary evidence, or a copy, is inadmissible in
court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
Forensic Readiness - Accurate answers An organization's ability to make optimal use of digital
evidence in a limited period and with minimal investigation costs.
Fourth Amendment - Accurate answers Protects against unreasonable search and seizure.
Government agents may not search or seize areas or things in which a person has reasonable
expectation of privacy, without a search warrant.
Chain of Custody - Accurate answers a written record of all people who have had possession of an
item of evidence
