WGU C840 OA DIGITAL FORENSICS FULLY
SOLVED OBJECTIVE ASSESSMENT PAPER
GRADED A+
◉ If the computer is turned on when you arrive, what does the
Secret Service recommend you do?
A. Begin your investigation immediately.
B. Shut the computer down according to the recommended Secret
Service procedure.
C. Transport the computer with power on.
D. Unplug the machine immediately..
Answer: B. Shut the computer down according to the recommended
Secret Service procedure
◉ Why should you note all cable connections for a computer you
want to seize as evidence?
A. To know what outside connections existed
B. In case other devices were connected
C. To know what peripheral devices existed
D. To know what hardware existed.
,Answer: B. In case other devices were connected
◉ What is the essence of the Daubert standard?
A. That only experts can testify at trial
B. That an expert must affirm that a tool or technique is valid
C. That only tools or techniques that have been accepted by the
scientific community are admissible at trial
D. That the chain of custody must be preserved.
Answer: C. That only tools or techniques that have been accepted by
the scientific community are admissible at trial
◉ When cataloging digital evidence, the primary goal is to do what?
A. Make bitstream images of all hard drives.
B. Preserve evidence integrity.
C. Keep evidence from being removed from the scene.
D. Keep the computer from being turned off..
Answer: B. Preserve evidence integrity
◉ Which of the following is important to the investigator regarding
logging?
,A. The logging methods
B. Log retention
C. Location of stored logs
D. All of the above.
Answer: D. All of the above
◉ Your roommate can give consent to search your computer.
A. True
B. False.
Answer: B. False
◉ Evidence need not be locked if it is at a police station.
A. True
B. False.
Answer: B. False
◉ When investigating a virus, what is the first step?
A. Check firewall logs.
, B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus..
Answer: C. Document the virus
◉ Which of the following crimes is most likely to leave email
evidence?
A. Cyberstalking
B. DoS
C. Logic bomb
D. Fraud.
Answer: A. Cyberstalking
◉ Where would you seek evidence that Ophcrack had been used on
a Windows Server 2008 machine?
A. In the logs of the server; look for the reboot of the system
B. In the logs of the server; look for the loading of a CD
C. In the firewall logs
D. In the IDS logs.
Answer: A. In the logs of the server; look for the reboot of the system
SOLVED OBJECTIVE ASSESSMENT PAPER
GRADED A+
◉ If the computer is turned on when you arrive, what does the
Secret Service recommend you do?
A. Begin your investigation immediately.
B. Shut the computer down according to the recommended Secret
Service procedure.
C. Transport the computer with power on.
D. Unplug the machine immediately..
Answer: B. Shut the computer down according to the recommended
Secret Service procedure
◉ Why should you note all cable connections for a computer you
want to seize as evidence?
A. To know what outside connections existed
B. In case other devices were connected
C. To know what peripheral devices existed
D. To know what hardware existed.
,Answer: B. In case other devices were connected
◉ What is the essence of the Daubert standard?
A. That only experts can testify at trial
B. That an expert must affirm that a tool or technique is valid
C. That only tools or techniques that have been accepted by the
scientific community are admissible at trial
D. That the chain of custody must be preserved.
Answer: C. That only tools or techniques that have been accepted by
the scientific community are admissible at trial
◉ When cataloging digital evidence, the primary goal is to do what?
A. Make bitstream images of all hard drives.
B. Preserve evidence integrity.
C. Keep evidence from being removed from the scene.
D. Keep the computer from being turned off..
Answer: B. Preserve evidence integrity
◉ Which of the following is important to the investigator regarding
logging?
,A. The logging methods
B. Log retention
C. Location of stored logs
D. All of the above.
Answer: D. All of the above
◉ Your roommate can give consent to search your computer.
A. True
B. False.
Answer: B. False
◉ Evidence need not be locked if it is at a police station.
A. True
B. False.
Answer: B. False
◉ When investigating a virus, what is the first step?
A. Check firewall logs.
, B. Check IDS logs.
C. Document the virus.
D. Trace the origin of the virus..
Answer: C. Document the virus
◉ Which of the following crimes is most likely to leave email
evidence?
A. Cyberstalking
B. DoS
C. Logic bomb
D. Fraud.
Answer: A. Cyberstalking
◉ Where would you seek evidence that Ophcrack had been used on
a Windows Server 2008 machine?
A. In the logs of the server; look for the reboot of the system
B. In the logs of the server; look for the loading of a CD
C. In the firewall logs
D. In the IDS logs.
Answer: A. In the logs of the server; look for the reboot of the system
