WGU C702/ CHFI Preliminary baseline test knowledge
training Questions and all Questions Accurately
Answered Latest 2025/2026
The MBR partition table structure is ____ bytes. - correct answer 64
(chapter 3): the mbr partition table structure is 64 bytes. The mbr length is 512 bytes.
The other answers are made up.
This requires federal agencies to develop, document, and implement information
security programs. - correct answer fisma
(chapter 7): the federal information security management act (fisma) requires federal
agencies to develop, document, and implement information security programs. Hipaa is
for healthcare. Glba requires financial institutions to protect their customers' information
against security threats. Sox is to protect investors from fraudulent accounting.
In exhibit numbering, the zz is for: - correct answer sequence number of parts of the
same exhibit
(chapter 2): the "zz" refers to the sequence number for parts of the same exhibit. Aaa is
for the investigator's initials. The date of the seizure is in day, month, year (dd/mm/yy)
format. The number of exhibits is nnnn.
What is not a challenge of log management? - correct answer log generation
(chapter 7): log generation is not a challenge of log management. The other three
answers are the challenges of log management.
This command can be used to see the names of all open shared files and the number of
file locks. - correct answer net file
,(chapter 6): the net file command displays the names of all open shared files and the
number of file locks. Netstat is a command to look for suspicious connections, but this
answer shows "net stat," which is not a valid command. Ls is used to list files in linux.
Psfile shows files opened remotely.
This is a two-digit network id number that is used along with the mcc (mobile country
code) printed on sim, that is used to identify the sim user on a mobile network. - correct
answer mnc
(chapter 13): mobile network code (mnc) is correct. Msc (mobile switching center)
processes calls and messages within a network and routes them between landline and
wireless networks. Bts (base transceiver station) is equipment that facilitates the user
with wireless communication between the mobile phone and the network. Mcc2 is a
made up answer.
Bigchfidog.com is an e-commerce business with $500,000 in annual revenue. Last
night, for about 4 hours, their customers were unable to access the website for
shopping. What type of attack did they most likely experience? - correct answer ddos
(chapter 8): from the description, this is most likely a denial of service type attack. Since
ddos is the only denial of service attack listed, this is the correct answer.
The img_stat command: - correct answer displays details of an image file
(chapter 3): the img_stat of tsk (the sleuth kit) displays details of an image file. General
details of a file system are displayed with the fsstat command. Istat displays metadata.
Fls lists file and directory names in a disk image.
The hex value of gif starts with: - correct answer 47 49 46
(chapter 3): ff d8 ff is for jpeg. 89 50 4e is for png files. The other answer is made up.
Which of the following is a starting hex value of an image file: - correct answer ff d8 ff
, (chapter 3): ff d8 ff is the starting hex value of jpeg files. The other choices are made up
answers.
This command can be used to analyze netbios over tcp/ip activity. - correct answer
nbtstat -s
(chapter 8): nbtstat -s can be used to analyze netbios over tcp/ip activity. Nbtstat -w is
not a valid command. Netstat and net session are not used for netbios.
This tool can be used to restore emails. - correct answer data recovery pro
(chapter 5): data recovery pro can be used to restore emails. Easeus offers precise
searching. File salvage is used to recover file in mac. Fsstat is made up.
Which of the following is true regarding digital evidence? - correct answer a duplicate
copy should be made for analysis
(chapter 1): an investigator should always have a duplicate copy of the digital evidence
and should use the duplicate for analysis.
This is a library and collection of command line tools for investigating disk images. -
correct answer tsk
(chapter 3): the sleuth kit (tsk) is a library and collection of command line tools for
investigating disk images. Tps is the name for the reports in the movie office space. Tks
and tpf are made up answers.
Richard wants to look for unusual network services. What command should he use? -
correct answer net start
training Questions and all Questions Accurately
Answered Latest 2025/2026
The MBR partition table structure is ____ bytes. - correct answer 64
(chapter 3): the mbr partition table structure is 64 bytes. The mbr length is 512 bytes.
The other answers are made up.
This requires federal agencies to develop, document, and implement information
security programs. - correct answer fisma
(chapter 7): the federal information security management act (fisma) requires federal
agencies to develop, document, and implement information security programs. Hipaa is
for healthcare. Glba requires financial institutions to protect their customers' information
against security threats. Sox is to protect investors from fraudulent accounting.
In exhibit numbering, the zz is for: - correct answer sequence number of parts of the
same exhibit
(chapter 2): the "zz" refers to the sequence number for parts of the same exhibit. Aaa is
for the investigator's initials. The date of the seizure is in day, month, year (dd/mm/yy)
format. The number of exhibits is nnnn.
What is not a challenge of log management? - correct answer log generation
(chapter 7): log generation is not a challenge of log management. The other three
answers are the challenges of log management.
This command can be used to see the names of all open shared files and the number of
file locks. - correct answer net file
,(chapter 6): the net file command displays the names of all open shared files and the
number of file locks. Netstat is a command to look for suspicious connections, but this
answer shows "net stat," which is not a valid command. Ls is used to list files in linux.
Psfile shows files opened remotely.
This is a two-digit network id number that is used along with the mcc (mobile country
code) printed on sim, that is used to identify the sim user on a mobile network. - correct
answer mnc
(chapter 13): mobile network code (mnc) is correct. Msc (mobile switching center)
processes calls and messages within a network and routes them between landline and
wireless networks. Bts (base transceiver station) is equipment that facilitates the user
with wireless communication between the mobile phone and the network. Mcc2 is a
made up answer.
Bigchfidog.com is an e-commerce business with $500,000 in annual revenue. Last
night, for about 4 hours, their customers were unable to access the website for
shopping. What type of attack did they most likely experience? - correct answer ddos
(chapter 8): from the description, this is most likely a denial of service type attack. Since
ddos is the only denial of service attack listed, this is the correct answer.
The img_stat command: - correct answer displays details of an image file
(chapter 3): the img_stat of tsk (the sleuth kit) displays details of an image file. General
details of a file system are displayed with the fsstat command. Istat displays metadata.
Fls lists file and directory names in a disk image.
The hex value of gif starts with: - correct answer 47 49 46
(chapter 3): ff d8 ff is for jpeg. 89 50 4e is for png files. The other answer is made up.
Which of the following is a starting hex value of an image file: - correct answer ff d8 ff
, (chapter 3): ff d8 ff is the starting hex value of jpeg files. The other choices are made up
answers.
This command can be used to analyze netbios over tcp/ip activity. - correct answer
nbtstat -s
(chapter 8): nbtstat -s can be used to analyze netbios over tcp/ip activity. Nbtstat -w is
not a valid command. Netstat and net session are not used for netbios.
This tool can be used to restore emails. - correct answer data recovery pro
(chapter 5): data recovery pro can be used to restore emails. Easeus offers precise
searching. File salvage is used to recover file in mac. Fsstat is made up.
Which of the following is true regarding digital evidence? - correct answer a duplicate
copy should be made for analysis
(chapter 1): an investigator should always have a duplicate copy of the digital evidence
and should use the duplicate for analysis.
This is a library and collection of command line tools for investigating disk images. -
correct answer tsk
(chapter 3): the sleuth kit (tsk) is a library and collection of command line tools for
investigating disk images. Tps is the name for the reports in the movie office space. Tks
and tpf are made up answers.
Richard wants to look for unusual network services. What command should he use? -
correct answer net start
