WGU C702/ CHFI Essential Test Toolkit Exam
Questions and solutions approved for credibility;
2025/2026
If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are
normally allocated
To this file? - correct answer 6 sectors
True - correct answer recovery of the deleted partition is the process by which the
investigator evaluates and extracts the
Deleted partitions.
True - correct answer during first responder procedure you should follow all laws while
collecting the evidence, and
Contact a computer forensic examiner as soon as possible
Which one of the following is not a consideration in a forensic readiness planning
checklist? - correct answer take permission from all employees of the organization
True - correct answer when collecting electronic evidence at the crime scene, the
collection should proceed from the most
Volatile to the least volatile
What is a chain of custody? - correct answer a legal document that demonstrates the
progression of evidence as it travels from the original
Evidence location to the forensic laboratory
Data is striped at a byte level across multiple drives and parity information is distributed
among all member drives. - correct answer raid level 5
,Computer forensics report provides detailed information on complete computer
forensics
Investigation process. It should explain how the incident occurred, provide technical
details of the
Incident and should be clear to understand. Which of the following attributes of a
forensics report
Can render it inadmissible in a court of law? - correct answer it is based on logical
assumptions about the incident timeline
Email spoofing refers to: - correct answer the forgery of an email header so that the
message appears to have originated from someone or
Somewhere other than the actual source
True - correct answer volatile information can be easily modified or lost when the
system is shut down or rebooted. It
Helps to determine a logical timeline of the security incident and the users who would
be
Responsible
True - correct answer a steganographic file system is a method to store the files in a
way that encrypts and hides the data
Without the knowledge of others
Which device in a wireless local area network (wlan) determines the next network point
to which a
Packet should be forwarded toward its destination? - correct answer wireless router
True - correct answer data acquisition is the process of imaging or otherwise obtaining
information from a digital device
And its peripheral equipment and media
,Lba (logical block address) addresses data by allotting a ___________to each sector of
the hard disk. - correct answer sequential number
Buffer overflow occurs when an application writes more data to a block of memory, or
buffer, than
The buffer is allocated to hold. Buffer overflow attacks allow an attacker to modify the
_______________in order to control the process execution, crash the process and
modify internal
Variables - correct answer target process's address space
True - correct answer physical security recommendations: there should be only one
entrance to a forensics lab
File signature analysis involves collecting information from the __________ of a file to
determine the
Type and function of the file - correct answer first 20 bytes
False - correct answer you should always work with original evidence
When a system is compromised, attackers often try to disable auditing, in windows 7;
modifications
To the audit policy are recorded as entries of event id____________. - correct answer
4902
Which of the following network attacks refers to sending huge volumes of email to an
address in an
Attempt to overflow the mailbox, or overwhelm the server where the email address is
hosted, to
Cause a denial-of-service attack? - correct answer mail bombing
Which of the following file in novel groupwise stores information about user accounts? -
correct answer ngwguard.db
, False - correct answer digital evidence is not fragile in nature.
Which of the following log injection attacks uses white space padding to create unusual
log entries? - correct answer word wrap abuse attack
Which of the following is not correct when documenting an electronic crime scene? -
correct answer write down the color of shirt and pant the suspect was wearing
True - correct answer under no circumstances should anyone, with the exception of
qualified computer forensics
Personnel, make any attempts to restore or recover information from a computer
system or device
That holds electronic information.
Syslog is a client/server protocol standard for forwarding log messages across an ip
network. Syslog
Uses ___________to transfer log messages in a clear text format. - correct answer tcp
An image is an artifact that reproduces the likeness of some subject. These are
produced by optical
Devices (i.e. Cameras, mirrors, lenses, telescopes, and microscopes).
Which property of the image shows you the number of colors available for each pixel in
an image? - correct answer bit depth
Which of the following statements is incorrect related to acquiring electronic evidence at
crime
Scene? - correct answer at the time of seizing process, you need to shut down the
computer immediately
Depending upon the jurisdictional areas, different laws apply to different incidents.
Which of the
Questions and solutions approved for credibility;
2025/2026
If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are
normally allocated
To this file? - correct answer 6 sectors
True - correct answer recovery of the deleted partition is the process by which the
investigator evaluates and extracts the
Deleted partitions.
True - correct answer during first responder procedure you should follow all laws while
collecting the evidence, and
Contact a computer forensic examiner as soon as possible
Which one of the following is not a consideration in a forensic readiness planning
checklist? - correct answer take permission from all employees of the organization
True - correct answer when collecting electronic evidence at the crime scene, the
collection should proceed from the most
Volatile to the least volatile
What is a chain of custody? - correct answer a legal document that demonstrates the
progression of evidence as it travels from the original
Evidence location to the forensic laboratory
Data is striped at a byte level across multiple drives and parity information is distributed
among all member drives. - correct answer raid level 5
,Computer forensics report provides detailed information on complete computer
forensics
Investigation process. It should explain how the incident occurred, provide technical
details of the
Incident and should be clear to understand. Which of the following attributes of a
forensics report
Can render it inadmissible in a court of law? - correct answer it is based on logical
assumptions about the incident timeline
Email spoofing refers to: - correct answer the forgery of an email header so that the
message appears to have originated from someone or
Somewhere other than the actual source
True - correct answer volatile information can be easily modified or lost when the
system is shut down or rebooted. It
Helps to determine a logical timeline of the security incident and the users who would
be
Responsible
True - correct answer a steganographic file system is a method to store the files in a
way that encrypts and hides the data
Without the knowledge of others
Which device in a wireless local area network (wlan) determines the next network point
to which a
Packet should be forwarded toward its destination? - correct answer wireless router
True - correct answer data acquisition is the process of imaging or otherwise obtaining
information from a digital device
And its peripheral equipment and media
,Lba (logical block address) addresses data by allotting a ___________to each sector of
the hard disk. - correct answer sequential number
Buffer overflow occurs when an application writes more data to a block of memory, or
buffer, than
The buffer is allocated to hold. Buffer overflow attacks allow an attacker to modify the
_______________in order to control the process execution, crash the process and
modify internal
Variables - correct answer target process's address space
True - correct answer physical security recommendations: there should be only one
entrance to a forensics lab
File signature analysis involves collecting information from the __________ of a file to
determine the
Type and function of the file - correct answer first 20 bytes
False - correct answer you should always work with original evidence
When a system is compromised, attackers often try to disable auditing, in windows 7;
modifications
To the audit policy are recorded as entries of event id____________. - correct answer
4902
Which of the following network attacks refers to sending huge volumes of email to an
address in an
Attempt to overflow the mailbox, or overwhelm the server where the email address is
hosted, to
Cause a denial-of-service attack? - correct answer mail bombing
Which of the following file in novel groupwise stores information about user accounts? -
correct answer ngwguard.db
, False - correct answer digital evidence is not fragile in nature.
Which of the following log injection attacks uses white space padding to create unusual
log entries? - correct answer word wrap abuse attack
Which of the following is not correct when documenting an electronic crime scene? -
correct answer write down the color of shirt and pant the suspect was wearing
True - correct answer under no circumstances should anyone, with the exception of
qualified computer forensics
Personnel, make any attempts to restore or recover information from a computer
system or device
That holds electronic information.
Syslog is a client/server protocol standard for forwarding log messages across an ip
network. Syslog
Uses ___________to transfer log messages in a clear text format. - correct answer tcp
An image is an artifact that reproduces the likeness of some subject. These are
produced by optical
Devices (i.e. Cameras, mirrors, lenses, telescopes, and microscopes).
Which property of the image shows you the number of colors available for each pixel in
an image? - correct answer bit depth
Which of the following statements is incorrect related to acquiring electronic evidence at
crime
Scene? - correct answer at the time of seizing process, you need to shut down the
computer immediately
Depending upon the jurisdictional areas, different laws apply to different incidents.
Which of the
