WGU D431 Digital Forensics Exam 136 Questions
with Verified Answers
ECPA (Electronic Communications Privacy Act) - CORRECT ANSWER Which law
requires both parties to consent to the recording of a conversation?
Health Insurance Portability and Accountability Act (HIPAA) - CORRECT ANSWER
Which law is related to the disclosure of personally identifiable protected health
information (PHI)?
18 U.S.C. 2252B - CORRECT ANSWER Which U.S. law criminalizes the act of
knowingly using a misleading domain name with the intent to deceive a minor
into viewing harmful material?
The Privacy Protection Act (PPA) - CORRECT ANSWER Which U.S. law protects
journalists from turning over their work or sources to law enforcement before the
information is shared with the public?
NIST SP 800-72 Guidelines - CORRECT ANSWER Which law or guideline lists the
four states a mobile device can be in when data is extracted from it?
Communications Assistance to Law Enforcement Act (CALEA) - CORRECT ANSWER
Which law includes a provision permitting the wiretapping of VoIP calls?
,The email sender must provide some mechanism whereby the receiver can opt
out of future emails and that method cannot require the receiver to pay in order
to opt out. - CORRECT ANSWER Which policy is included in the CAN-SPAM Act?
Communications Assistance to Law Enforcement Act (CALEA) - CORRECT ANSWER
Which United States law requires telecommunications equipment manufacturers
to provide built-in surveillance capabilities for federal agencies?
The Fourth Amendment to the U.S. Constitution - CORRECT ANSWER Which law
requires a search warrant or one of the recognized exceptions to the search
warrant requirements for searching email messages on a computer?
SAM file in \Windows\System32\ - CORRECT ANSWER Where are local passwords
stored for the Windows operating system?
C:\Windows\System32 - CORRECT ANSWER Where on a Windows system is the
config folder located that contains the SAM file?
Registry - CORRECT ANSWER A forensic examiner wants to try to extract
passwords for wireless networks to which a system was connected. Where should
passwords for wireless networks be stored on a Windows XP system?
Ophcrack - CORRECT ANSWER Which Windows password cracking tool uses
rainbow tables?
, It uses a table of all possible keyboard combinations and their hash values, then
searches for a match. - CORRECT ANSWER How does a rainbow table work to
crack a password?
Email header - CORRECT ANSWER What should a forensic investigator use to
gather the most reliable routing information for tracking an email message?
Determining the ownership of the source email server - CORRECT ANSWER Which
activity involves email tracing?
/var/log - CORRECT ANSWER A forensic examiner reviews a laptop running OS X
which has been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives. Which digital evidence should be
reviewed?
/var/spool/cups - CORRECT ANSWER Which log or folder contains information
about printed documents on a computer running Mac OS X?
Security - CORRECT ANSWER Which Windows event log should be checked for
evidence of invalid logon attempts?
/Library/Receipts - CORRECT ANSWER A cyber security organization has issued a
warning about a cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator decides to
examine the software updates logs on a Macintosh system to ensure the system
has been patched. Which folder contains the software updates logs?
with Verified Answers
ECPA (Electronic Communications Privacy Act) - CORRECT ANSWER Which law
requires both parties to consent to the recording of a conversation?
Health Insurance Portability and Accountability Act (HIPAA) - CORRECT ANSWER
Which law is related to the disclosure of personally identifiable protected health
information (PHI)?
18 U.S.C. 2252B - CORRECT ANSWER Which U.S. law criminalizes the act of
knowingly using a misleading domain name with the intent to deceive a minor
into viewing harmful material?
The Privacy Protection Act (PPA) - CORRECT ANSWER Which U.S. law protects
journalists from turning over their work or sources to law enforcement before the
information is shared with the public?
NIST SP 800-72 Guidelines - CORRECT ANSWER Which law or guideline lists the
four states a mobile device can be in when data is extracted from it?
Communications Assistance to Law Enforcement Act (CALEA) - CORRECT ANSWER
Which law includes a provision permitting the wiretapping of VoIP calls?
,The email sender must provide some mechanism whereby the receiver can opt
out of future emails and that method cannot require the receiver to pay in order
to opt out. - CORRECT ANSWER Which policy is included in the CAN-SPAM Act?
Communications Assistance to Law Enforcement Act (CALEA) - CORRECT ANSWER
Which United States law requires telecommunications equipment manufacturers
to provide built-in surveillance capabilities for federal agencies?
The Fourth Amendment to the U.S. Constitution - CORRECT ANSWER Which law
requires a search warrant or one of the recognized exceptions to the search
warrant requirements for searching email messages on a computer?
SAM file in \Windows\System32\ - CORRECT ANSWER Where are local passwords
stored for the Windows operating system?
C:\Windows\System32 - CORRECT ANSWER Where on a Windows system is the
config folder located that contains the SAM file?
Registry - CORRECT ANSWER A forensic examiner wants to try to extract
passwords for wireless networks to which a system was connected. Where should
passwords for wireless networks be stored on a Windows XP system?
Ophcrack - CORRECT ANSWER Which Windows password cracking tool uses
rainbow tables?
, It uses a table of all possible keyboard combinations and their hash values, then
searches for a match. - CORRECT ANSWER How does a rainbow table work to
crack a password?
Email header - CORRECT ANSWER What should a forensic investigator use to
gather the most reliable routing information for tracking an email message?
Determining the ownership of the source email server - CORRECT ANSWER Which
activity involves email tracing?
/var/log - CORRECT ANSWER A forensic examiner reviews a laptop running OS X
which has been compromised. The examiner wants to know if there were any
mounted volumes created from USB drives. Which digital evidence should be
reviewed?
/var/spool/cups - CORRECT ANSWER Which log or folder contains information
about printed documents on a computer running Mac OS X?
Security - CORRECT ANSWER Which Windows event log should be checked for
evidence of invalid logon attempts?
/Library/Receipts - CORRECT ANSWER A cyber security organization has issued a
warning about a cybercriminal who is using a known vulnerability to attack
unpatched corporate Macintosh systems. A network administrator decides to
examine the software updates logs on a Macintosh system to ensure the system
has been patched. Which folder contains the software updates logs?
