1
WGU C702 OA FINAL EXAM Actual Exam
2026/2027 Complete Questions and Verified
Answers Brand New Version Pass
Guaranteed - A+ Graded
SECTION 1: FOUNDATIONS OF FORENSIC SCIENCE (Questions 1-15)
Q1: A digital forensics investigator arrives at a crime scene and needs to acquire data from a
running computer. According to the order of volatility, what should be collected FIRST?
A. Hard drive contents
B. RAM (memory). [CORRECT]
C. Network connections
D. Swap space
Correct Answer: B
Rationale: The order of volatility dictates that the most volatile data should be collected first.
RAM contents (B) are lost when power is removed and are the most volatile. Network
connections (C) are also volatile but less than RAM. Hard drive contents (A) and swap space (D)
are non-volatile and can be collected later.
Q2: During a crime scene investigation, an investigator notices a sticky note with a password
written on it attached to a suspect's monitor. What type of evidence is this?
A. Digital evidence
B. Physical evidence. [CORRECT]
C. Testimonial evidence
D. Demonstrative evidence
Correct Answer: B
Rationale: The sticky note is a tangible object found at the scene, making it physical evidence
(B). While it contains information that may lead to digital evidence, the note itself is a physical
object. Testimonial evidence (C) involves statements from witnesses, and demonstrative
evidence (D) includes charts or diagrams used to explain evidence.
,2
Q3: Which principle states that when two objects come into contact, there is always a transfer of
material between them?
A. Murphy's Law
B. Locard's Exchange Principle. [CORRECT]
C. Daubert Standard
D. Moore's Law
Correct Answer: B
Rationale: Locard's Exchange Principle (B) is the foundational concept that every contact leaves
a trace, crucial for forensic science. The Daubert Standard (C) relates to admissibility of expert
testimony, while Murphy's Law (A) and Moore's Law (D) are unrelated to forensic evidence
transfer.
Q4: A forensic investigator is testifying in court about a fingerprint found at a crime scene. The
defense attorney challenges the methodology used to analyze the print. Which legal standard will
the judge most likely apply to determine if the testimony is admissible?
A. Frye Standard
B. Federal Rules of Evidence 702
C. Daubert Standard. [CORRECT]
D. Brady Rule
Correct Answer: C
Rationale: The Daubert Standard (C) is the current federal standard for admitting expert
scientific testimony, requiring the methodology to be scientifically valid and relevant. While
Frye (A) is still used in some states, Daubert is the prevailing federal standard. FRE 702 (B)
governs expert testimony generally, and the Brady Rule (D) concerns exculpatory evidence.
Q5: In a cybercrime case, investigators seize a laptop, external hard drive, USB flash drive, and
smartphone. Which item requires the most stringent chain of custody documentation to ensure
admissibility in court?
A. The laptop only
B. All items equally. [CORRECT]
C. Only the external hard drive
D. Only the smartphone
Correct Answer: B
Rationale: Chain of custody applies equally to all evidence (B) to maintain integrity and
admissibility. Every piece of evidence, regardless of type or storage medium, requires proper
,3
documentation of collection, handling, storage, and transfer to prevent challenges to authenticity
and integrity.
Q6: An investigator is processing a crime scene where a server room fire has damaged computer
equipment. What is the FIRST priority before evidence collection begins?
A. Create forensic images of all drives
B. Ensure scene safety and preserve life. [CORRECT]
C. Photograph all equipment
D. Interview witnesses
Correct Answer: B
Rationale: Scene safety and preservation of life (B) always take precedence over evidence
collection. Forensic imaging (A), photography (C), and interviews (D) occur only after the scene
is secured and safe for personnel to enter.
Q7: A forensic analyst is examining a forged signature on a contract. The analyst compares
microscopic characteristics of the signature against known samples. What type of evidence
characteristics is the analyst evaluating?
A. Class characteristics
B. Individual characteristics. [CORRECT]
C. Physical characteristics only
D. Circumstantial evidence
Correct Answer: B
Rationale: Individual characteristics (B) are unique features that can identify a specific source,
such as microscopic variations in handwriting. Class characteristics (A) would only group
evidence into a category. The analysis involves both physical and unique identifying features.
Q8: During a digital forensics investigation, an analyst discovers that a suspect's hard drive has
been wiped with a single pass of zeros. What type of evidence destruction does this represent?
A. Accidental deletion
B. Data hiding
C. Anti-forensics. [CORRECT]
D. Normal system operation
Correct Answer: C
Rationale: Intentionally wiping a drive to destroy evidence is an anti-forensics technique (C).
, 4
This goes beyond simple deletion and represents deliberate action to prevent forensic recovery.
Data hiding (B) conceals rather than destroys data.
Q9: An investigator needs to demonstrate the trajectory of a cyber attack in court using a
network diagram with timestamps. What type of evidence is this demonstration?
A. Documentary evidence
B. Real evidence
C. Demonstrative evidence. [CORRECT]
D. Testimonial evidence
Correct Answer: C
Rationale: Demonstrative evidence (C) includes charts, diagrams, and visual aids used to help
the jury understand complex information. While based on documentary evidence (A), the
visualization itself is demonstrative. Real evidence (B) would be the actual logs, and testimonial
(D) involves witness statements.
Q10: A crime scene technician is packaging a hard drive for transport to the forensic laboratory.
Which packaging material is MOST appropriate to prevent static damage?
A. Standard paper envelope
B. Anti-static bag. [CORRECT]
C. Plastic grocery bag
D. Aluminum foil
Correct Answer: B
Rationale: Anti-static bags (B) are specifically designed to protect electronic components from
electrostatic discharge. Paper (A) doesn't protect against static, plastic bags (C) can generate
static electricity, and aluminum foil (D) can cause short circuits if it contacts circuit boards.
Q11: In a corporate espionage case, an employee is suspected of stealing trade secrets. The
investigator finds that the suspect accessed files outside normal business hours. This pattern of
behavior represents what type of evidence?
A. Direct evidence
B. Circumstantial evidence. [CORRECT]
C. Hearsay evidence
D. Physical evidence
WGU C702 OA FINAL EXAM Actual Exam
2026/2027 Complete Questions and Verified
Answers Brand New Version Pass
Guaranteed - A+ Graded
SECTION 1: FOUNDATIONS OF FORENSIC SCIENCE (Questions 1-15)
Q1: A digital forensics investigator arrives at a crime scene and needs to acquire data from a
running computer. According to the order of volatility, what should be collected FIRST?
A. Hard drive contents
B. RAM (memory). [CORRECT]
C. Network connections
D. Swap space
Correct Answer: B
Rationale: The order of volatility dictates that the most volatile data should be collected first.
RAM contents (B) are lost when power is removed and are the most volatile. Network
connections (C) are also volatile but less than RAM. Hard drive contents (A) and swap space (D)
are non-volatile and can be collected later.
Q2: During a crime scene investigation, an investigator notices a sticky note with a password
written on it attached to a suspect's monitor. What type of evidence is this?
A. Digital evidence
B. Physical evidence. [CORRECT]
C. Testimonial evidence
D. Demonstrative evidence
Correct Answer: B
Rationale: The sticky note is a tangible object found at the scene, making it physical evidence
(B). While it contains information that may lead to digital evidence, the note itself is a physical
object. Testimonial evidence (C) involves statements from witnesses, and demonstrative
evidence (D) includes charts or diagrams used to explain evidence.
,2
Q3: Which principle states that when two objects come into contact, there is always a transfer of
material between them?
A. Murphy's Law
B. Locard's Exchange Principle. [CORRECT]
C. Daubert Standard
D. Moore's Law
Correct Answer: B
Rationale: Locard's Exchange Principle (B) is the foundational concept that every contact leaves
a trace, crucial for forensic science. The Daubert Standard (C) relates to admissibility of expert
testimony, while Murphy's Law (A) and Moore's Law (D) are unrelated to forensic evidence
transfer.
Q4: A forensic investigator is testifying in court about a fingerprint found at a crime scene. The
defense attorney challenges the methodology used to analyze the print. Which legal standard will
the judge most likely apply to determine if the testimony is admissible?
A. Frye Standard
B. Federal Rules of Evidence 702
C. Daubert Standard. [CORRECT]
D. Brady Rule
Correct Answer: C
Rationale: The Daubert Standard (C) is the current federal standard for admitting expert
scientific testimony, requiring the methodology to be scientifically valid and relevant. While
Frye (A) is still used in some states, Daubert is the prevailing federal standard. FRE 702 (B)
governs expert testimony generally, and the Brady Rule (D) concerns exculpatory evidence.
Q5: In a cybercrime case, investigators seize a laptop, external hard drive, USB flash drive, and
smartphone. Which item requires the most stringent chain of custody documentation to ensure
admissibility in court?
A. The laptop only
B. All items equally. [CORRECT]
C. Only the external hard drive
D. Only the smartphone
Correct Answer: B
Rationale: Chain of custody applies equally to all evidence (B) to maintain integrity and
admissibility. Every piece of evidence, regardless of type or storage medium, requires proper
,3
documentation of collection, handling, storage, and transfer to prevent challenges to authenticity
and integrity.
Q6: An investigator is processing a crime scene where a server room fire has damaged computer
equipment. What is the FIRST priority before evidence collection begins?
A. Create forensic images of all drives
B. Ensure scene safety and preserve life. [CORRECT]
C. Photograph all equipment
D. Interview witnesses
Correct Answer: B
Rationale: Scene safety and preservation of life (B) always take precedence over evidence
collection. Forensic imaging (A), photography (C), and interviews (D) occur only after the scene
is secured and safe for personnel to enter.
Q7: A forensic analyst is examining a forged signature on a contract. The analyst compares
microscopic characteristics of the signature against known samples. What type of evidence
characteristics is the analyst evaluating?
A. Class characteristics
B. Individual characteristics. [CORRECT]
C. Physical characteristics only
D. Circumstantial evidence
Correct Answer: B
Rationale: Individual characteristics (B) are unique features that can identify a specific source,
such as microscopic variations in handwriting. Class characteristics (A) would only group
evidence into a category. The analysis involves both physical and unique identifying features.
Q8: During a digital forensics investigation, an analyst discovers that a suspect's hard drive has
been wiped with a single pass of zeros. What type of evidence destruction does this represent?
A. Accidental deletion
B. Data hiding
C. Anti-forensics. [CORRECT]
D. Normal system operation
Correct Answer: C
Rationale: Intentionally wiping a drive to destroy evidence is an anti-forensics technique (C).
, 4
This goes beyond simple deletion and represents deliberate action to prevent forensic recovery.
Data hiding (B) conceals rather than destroys data.
Q9: An investigator needs to demonstrate the trajectory of a cyber attack in court using a
network diagram with timestamps. What type of evidence is this demonstration?
A. Documentary evidence
B. Real evidence
C. Demonstrative evidence. [CORRECT]
D. Testimonial evidence
Correct Answer: C
Rationale: Demonstrative evidence (C) includes charts, diagrams, and visual aids used to help
the jury understand complex information. While based on documentary evidence (A), the
visualization itself is demonstrative. Real evidence (B) would be the actual logs, and testimonial
(D) involves witness statements.
Q10: A crime scene technician is packaging a hard drive for transport to the forensic laboratory.
Which packaging material is MOST appropriate to prevent static damage?
A. Standard paper envelope
B. Anti-static bag. [CORRECT]
C. Plastic grocery bag
D. Aluminum foil
Correct Answer: B
Rationale: Anti-static bags (B) are specifically designed to protect electronic components from
electrostatic discharge. Paper (A) doesn't protect against static, plastic bags (C) can generate
static electricity, and aluminum foil (D) can cause short circuits if it contacts circuit boards.
Q11: In a corporate espionage case, an employee is suspected of stealing trade secrets. The
investigator finds that the suspect accessed files outside normal business hours. This pattern of
behavior represents what type of evidence?
A. Direct evidence
B. Circumstantial evidence. [CORRECT]
C. Hearsay evidence
D. Physical evidence
