WGU C706 Test Prep (Secure Software Design) –
Questions With Objective Solutions
Which tool is a mobile forensic acquisition and analysis tool for cell phones,
smartphones, tablets and GPS devices which supports both logical and
physical acquisition of data and also allows one to perform cloud data
acquisition from mobile devices.
a. Cellebrite UFED Logical Analyzer
b. Paraben's E3 DS
c. Oxygen Forensic Extractor
d. XRY Logical Accurate Answer:- b. Paraben's E3 DS
Paraben's E3 DS is a mobile forensic acquisition and analysis tool for cell
phones, smartphones, tablets, and GPS devices which supports both logical
and physical acquisition of data. It also allows one to perform cloud data
acquisition from mobile devices.
Cellebrite UFED Logical Analyzer extracts and analyzes data from mobile
devices. It has a built-in SIM reader that allows the device to obtain data such
as call logs, phonebooks, SMS, IMSI, and ICCID. The device also supports SIM
card cloning.
XRY LOGICAL is a software-based solution comprising the hardware required
for the forensic investigation of mobile devices. It analyzes a wide range of
mobile phones using a secure examination process to recover data in a
forensically secure manner. It enables investigators to perform logical data
acquisition on mobile phones.
Oxygen Forensic Extractor enables wired (USB) and wireless (Bluetooth) data
acquisition from mobile devices running on a variety of platforms.
What is not a command used to determine logged-on users?
a. LoggedSessions
b. PSLoggedOn
c. Net Sessions
d. LogonSessions Accurate Answer:- a. LoggedSessions
,PsLoggedOn: is an applet that displays both the users logged on locally and via
resources for either on the local, or a remote computer
net session: command is used for managing server computer connections. It
displays computer and usernames on a server, open files, and duration of
sessions
LogonSessions: when run without any options, lists the currently active
logged-on sessions. If the -p option is used, it provides information on the
processes running in each session.
The net file command reflects names of all files that are open on the server
and the number of file locks on each file, if any.
This command can also close individually shared files and remove file locks.
When used without parameters, the tool will list the open files and help
control the files shared on a network. Accurate Answer:-
What command is used to determine the NetBIOS name table cache in
Windows? Accurate Answer:- Nbtstat
nbtstat helps troubleshoot NetBIOS name resolution problems.
When a network is functioning normally, NetBIOS over TCP/IP (NetBT)
resolves NetBIOS names to IP addresses.
▪ -n: Displays the names that have been registered locally on the system by
NetBIOS applications such as the server and redirector
▪ -r: Displays the count of all NetBIOS names resolved by broadcast and by
querying a Windows Internet Naming Service (WINS) server
▪ -S: Lists the current NetBIOS sessions and their statuses
▪ -a: Shows details of the NetBIOS remote machine name table
Which tool helps collect information about network connections operating in
a Windows system? Accurate Answer:- netstat
A TCP/IP utility that shows the status of each active connection.
,Which of the following is not a command used to determine running processes
in Windows?
a. Tasklist
b. Netstat
c. PSList
d. Listdlls Accurate Answer:- b. Netstat
Tasklist displays a list of applications and services with their Process ID (PID)
for all tasks running on either a local or a remote computer
Pslist Source: https://docs.microsoft.com
pslist.exe displays basic information about the already running processes on a
system, including the amount of time each process has been running (in both
kernel and user modes).
ListDLLs Source: https://docs.microsoft.com
ListDLLs is a utility that reports the DLLs loaded into processes. You can use it
to list all DLLs loaded into all the processes, into a specific process, or to list
the processes that have a particular DLL loaded. ListDLLs can also display full
version information for DLLs, including their digital signature, and it can also
scan processes for unsigned DLLs.
The information about the system users is stored in which file?
a. SAM database file
b. PAT database file
c. NTUSER.DAT
d. NTUSER.BAT Accurate Answer:- a. SAM database file
Information about the system users is stored in the Security Account Manager
(SAM) database file.
Each user's registry settings for their specific account are stored in the
NTUSER.DAT registry file.
The value 0 associated with the registry entry Enable Prefetcher tells the
system to use which prefetch?
, a. Application prefetching is enabled
b. Boot prefetching is enabled.
c. Prefetching is disabled.
d. Both application and boot prefetching are enabled. Accurate Answer:-
c. Prefetching is disabled.
EnablePrefetcher reg key values:
0: Prefetching is disabled
1: Application prefetching is enabled
2: Boot prefetching is enabled
3: Both application and boot prefetching are enabled
What prefetch does value 2 from the registry entry EnablePrefetcher tell the
system to use?
a. Both application and boot prefetching are enabled
b. Application prefetching is enabled
c. Prefetching is enabled
d. Boot prefetching is enabled Accurate Answer:- d. Boot prefetching is
enabled
EnablePrefetcher reg key values:
0: Prefetching is disabled
1: Application prefetching is enabled
2: Boot prefetching is enabled
3: Both application and boot prefetching are enabled
Which command is used to determine open files?
a. Openfile
b. Net file
c. PSFiles
d. Open files Accurate Answer:- b. Net file
What prefetch does value 1 from the registry entry EnablePrefetcher tell the
system to use?
a. Both application and boot prefetching are enabled
b. Boot prefetching is enabled
Questions With Objective Solutions
Which tool is a mobile forensic acquisition and analysis tool for cell phones,
smartphones, tablets and GPS devices which supports both logical and
physical acquisition of data and also allows one to perform cloud data
acquisition from mobile devices.
a. Cellebrite UFED Logical Analyzer
b. Paraben's E3 DS
c. Oxygen Forensic Extractor
d. XRY Logical Accurate Answer:- b. Paraben's E3 DS
Paraben's E3 DS is a mobile forensic acquisition and analysis tool for cell
phones, smartphones, tablets, and GPS devices which supports both logical
and physical acquisition of data. It also allows one to perform cloud data
acquisition from mobile devices.
Cellebrite UFED Logical Analyzer extracts and analyzes data from mobile
devices. It has a built-in SIM reader that allows the device to obtain data such
as call logs, phonebooks, SMS, IMSI, and ICCID. The device also supports SIM
card cloning.
XRY LOGICAL is a software-based solution comprising the hardware required
for the forensic investigation of mobile devices. It analyzes a wide range of
mobile phones using a secure examination process to recover data in a
forensically secure manner. It enables investigators to perform logical data
acquisition on mobile phones.
Oxygen Forensic Extractor enables wired (USB) and wireless (Bluetooth) data
acquisition from mobile devices running on a variety of platforms.
What is not a command used to determine logged-on users?
a. LoggedSessions
b. PSLoggedOn
c. Net Sessions
d. LogonSessions Accurate Answer:- a. LoggedSessions
,PsLoggedOn: is an applet that displays both the users logged on locally and via
resources for either on the local, or a remote computer
net session: command is used for managing server computer connections. It
displays computer and usernames on a server, open files, and duration of
sessions
LogonSessions: when run without any options, lists the currently active
logged-on sessions. If the -p option is used, it provides information on the
processes running in each session.
The net file command reflects names of all files that are open on the server
and the number of file locks on each file, if any.
This command can also close individually shared files and remove file locks.
When used without parameters, the tool will list the open files and help
control the files shared on a network. Accurate Answer:-
What command is used to determine the NetBIOS name table cache in
Windows? Accurate Answer:- Nbtstat
nbtstat helps troubleshoot NetBIOS name resolution problems.
When a network is functioning normally, NetBIOS over TCP/IP (NetBT)
resolves NetBIOS names to IP addresses.
▪ -n: Displays the names that have been registered locally on the system by
NetBIOS applications such as the server and redirector
▪ -r: Displays the count of all NetBIOS names resolved by broadcast and by
querying a Windows Internet Naming Service (WINS) server
▪ -S: Lists the current NetBIOS sessions and their statuses
▪ -a: Shows details of the NetBIOS remote machine name table
Which tool helps collect information about network connections operating in
a Windows system? Accurate Answer:- netstat
A TCP/IP utility that shows the status of each active connection.
,Which of the following is not a command used to determine running processes
in Windows?
a. Tasklist
b. Netstat
c. PSList
d. Listdlls Accurate Answer:- b. Netstat
Tasklist displays a list of applications and services with their Process ID (PID)
for all tasks running on either a local or a remote computer
Pslist Source: https://docs.microsoft.com
pslist.exe displays basic information about the already running processes on a
system, including the amount of time each process has been running (in both
kernel and user modes).
ListDLLs Source: https://docs.microsoft.com
ListDLLs is a utility that reports the DLLs loaded into processes. You can use it
to list all DLLs loaded into all the processes, into a specific process, or to list
the processes that have a particular DLL loaded. ListDLLs can also display full
version information for DLLs, including their digital signature, and it can also
scan processes for unsigned DLLs.
The information about the system users is stored in which file?
a. SAM database file
b. PAT database file
c. NTUSER.DAT
d. NTUSER.BAT Accurate Answer:- a. SAM database file
Information about the system users is stored in the Security Account Manager
(SAM) database file.
Each user's registry settings for their specific account are stored in the
NTUSER.DAT registry file.
The value 0 associated with the registry entry Enable Prefetcher tells the
system to use which prefetch?
, a. Application prefetching is enabled
b. Boot prefetching is enabled.
c. Prefetching is disabled.
d. Both application and boot prefetching are enabled. Accurate Answer:-
c. Prefetching is disabled.
EnablePrefetcher reg key values:
0: Prefetching is disabled
1: Application prefetching is enabled
2: Boot prefetching is enabled
3: Both application and boot prefetching are enabled
What prefetch does value 2 from the registry entry EnablePrefetcher tell the
system to use?
a. Both application and boot prefetching are enabled
b. Application prefetching is enabled
c. Prefetching is enabled
d. Boot prefetching is enabled Accurate Answer:- d. Boot prefetching is
enabled
EnablePrefetcher reg key values:
0: Prefetching is disabled
1: Application prefetching is enabled
2: Boot prefetching is enabled
3: Both application and boot prefetching are enabled
Which command is used to determine open files?
a. Openfile
b. Net file
c. PSFiles
d. Open files Accurate Answer:- b. Net file
What prefetch does value 1 from the registry entry EnablePrefetcher tell the
system to use?
a. Both application and boot prefetching are enabled
b. Boot prefetching is enabled
