WGU C702/ CHFI Objective Assessment Exam Questions
verified for accuracy and top-rated solutions | 2025/2026
This command can be used to obtain details about partitions. - correct answer get-
partitiontable
(chapter 3): the get-partitiontable command provides details about partitions. The get-
gpt command is used for partitioning. The other two commands are made up and are
incorrect.
All investigators keep track of the evidence path by using the: - correct answer chain of
custody document
(chapter 1 and chapter 2): the chain of custody document is used to demonstrate the
progression of evidence from the original evidence location to the forensic lab. The
evidence progression and evidence path documents do not exist. Exhibit numbering is
part of collecting the evidence and labeling it for use in court.
Tasha is looking for the uefi phase that involves clearing uefi from memory. - correct
answer rt
(chapter 3): the runtime (rt) phase is where uefi is cleared from memory. The sec
(security) phase is where code is initialized. Bsd is not a uefi phase, but bds is, so this
answer is incorrect. Dxe (driver execution environment) contains hobl and does not
involve clearing the uefi from memory.
This person provides legal advice about the investigation and any potential legal issues
in the forensic investigation process. - correct answer attorney
(chapter 2): an attorney or legal adviser provides legal advice about the investigation
and any potential legal issues. A photographer is helping to document evidence, the
investigator is performing the actual investigation, and the incident responder is
, responding to the incident itself. With the statement of "legal advice," your focus should
be on attorney.
The guid has this number of hexadecimal digits, with groups separated by hyphens. -
correct answer 32
(chapter 3): the guid (globally unique identifier) has 32 hexadecimal digits, with groups
separated by hyphens. The guid is a 128 bit number generated by windows; however,
the question specifically asks for the number of hexadecimal digits. 512 bytes is the
length of the mbr and is incorrect. 64 is just added in for confusion and is incorrect.
This is a tool for mac that can be used to recover files from crashed or virus corrupted
hard drives. - correct answer file salvage
(chapter 5): file salvage is a tool for mac os that can be used to recover files from
crashed or virus corrupted hard drives. Total recall is used for raid. Recover my files is
for windows. Data recovery pro recovers deleted emails and email attachments.
Randill, inc has initiated an informal evidence collection process. Which type of
investigation usually has an informal process for evidence collection? - correct answer
civil
(chapter 1): a civil investigation is normally informal in the initial evidence gathering
process. Criminal investigations require a formal process. Administrative investigations
are also typically informal at first; however, the ec-council official material refers to civil
investigation as the answer. Nv investigation is a made up answer and is not correct.
A deposition is different from a regular trial in that: - correct answer both attorneys are
present
(chapter 14): both attorneys are present in a deposition. The other answers are
incorrect because a judge and/or jury are also present at the trial. This is found in
chapter 14 of the official ec-council material.
verified for accuracy and top-rated solutions | 2025/2026
This command can be used to obtain details about partitions. - correct answer get-
partitiontable
(chapter 3): the get-partitiontable command provides details about partitions. The get-
gpt command is used for partitioning. The other two commands are made up and are
incorrect.
All investigators keep track of the evidence path by using the: - correct answer chain of
custody document
(chapter 1 and chapter 2): the chain of custody document is used to demonstrate the
progression of evidence from the original evidence location to the forensic lab. The
evidence progression and evidence path documents do not exist. Exhibit numbering is
part of collecting the evidence and labeling it for use in court.
Tasha is looking for the uefi phase that involves clearing uefi from memory. - correct
answer rt
(chapter 3): the runtime (rt) phase is where uefi is cleared from memory. The sec
(security) phase is where code is initialized. Bsd is not a uefi phase, but bds is, so this
answer is incorrect. Dxe (driver execution environment) contains hobl and does not
involve clearing the uefi from memory.
This person provides legal advice about the investigation and any potential legal issues
in the forensic investigation process. - correct answer attorney
(chapter 2): an attorney or legal adviser provides legal advice about the investigation
and any potential legal issues. A photographer is helping to document evidence, the
investigator is performing the actual investigation, and the incident responder is
, responding to the incident itself. With the statement of "legal advice," your focus should
be on attorney.
The guid has this number of hexadecimal digits, with groups separated by hyphens. -
correct answer 32
(chapter 3): the guid (globally unique identifier) has 32 hexadecimal digits, with groups
separated by hyphens. The guid is a 128 bit number generated by windows; however,
the question specifically asks for the number of hexadecimal digits. 512 bytes is the
length of the mbr and is incorrect. 64 is just added in for confusion and is incorrect.
This is a tool for mac that can be used to recover files from crashed or virus corrupted
hard drives. - correct answer file salvage
(chapter 5): file salvage is a tool for mac os that can be used to recover files from
crashed or virus corrupted hard drives. Total recall is used for raid. Recover my files is
for windows. Data recovery pro recovers deleted emails and email attachments.
Randill, inc has initiated an informal evidence collection process. Which type of
investigation usually has an informal process for evidence collection? - correct answer
civil
(chapter 1): a civil investigation is normally informal in the initial evidence gathering
process. Criminal investigations require a formal process. Administrative investigations
are also typically informal at first; however, the ec-council official material refers to civil
investigation as the answer. Nv investigation is a made up answer and is not correct.
A deposition is different from a regular trial in that: - correct answer both attorneys are
present
(chapter 14): both attorneys are present in a deposition. The other answers are
incorrect because a judge and/or jury are also present at the trial. This is found in
chapter 14 of the official ec-council material.
