WGU C702/ CHFI | Advanced Problem Set Practice:
Fully Solved Questions for Guaranteed Success
2025/2026
What must an investigator do before disconnecting an ipod from any type of computer?
- correct answer unmount the ipod
A picture file is recovered from a computer under investigation. During the investigation
process, the file is enlarged 500% to get a better view of its contents. The picture quality
is not degraded at all from this process. What kind of picture is this file. What kind of
picture is this file? - correct answer vector image
At what layer does a cross site scripting attack occur on? - correct answer application
What is the smallest physical storage unit on a hard drive? - correct answer sector
How many times can data be written on a dvd+r disk? - correct answer once
If a pda is seized in an investigation while the device is turned on, what would be the
proper procedure? - correct answer keep the device powered on
When carrying out a forensics investigation, why should you never delete a partition on
a dynamic disk? - correct answer the action can corrupt the disk
A forensics investigator is searching the hard drive of a computer for the files that were
recently moved t othe recycle bin. He searched for the file in the c:\recycled using a
command line tool but does not find anything. What is the reason for this? - correct
answer the files are hidden and he must use switch to view them.
The efforts to obtain information before a trial by demanding documents, depositions,
question and answers written under oath, written requests for admissions of fact, and
,examination of the scene is a description of what legal term? - correct answer
discovery
Which legal document allows law enforcement to search an office, place of business, or
other locale for evidence relating to an alleged crime? - correct answer search warrant
What happens when a file is deleted by a microsoft operating system using the fat file
system? - correct answer only the reference to the file is removed from the fat and can
be recovered.
What feature of decryption collection allows an investigator to crack a password as
quickly as possible? - correct answer distribute processing over 16 or fewer computers
Davidson trucking is a small transportation company that has three local offices in
detroit michigan. Ten female employees that work for the company have gone to an
attorney reporting that male employees repeatedly harassed them and that
management did nothing to stop the problem. Davidson has employee policies that
outline all company guidelines, including awareness on harassment and how it will not
be tolerated. When the case is brought to court, whom should the prosecuting attorney
call upon for not upholding company policy? - correct answer supervisors
To preserve digital evidence, an investigator should ____________________. - correct
answer make two copies of each evidence item using different imaging tools
Why should you never power on a computer that you need to acquire digital evidence
from? - correct answer when the computer boots up, files are written to the computer
rendering the data clean
To check for pop3 traffic using ethereal, what port should an investigator search by? -
correct answer 110
An on-site incident response team is called to investigate an alleged case of computer
tampering within their company. Before proceeding with the investigation, the ceo
,informs them that the incident will be classified as low level. How long will the team
have to respond to the incident? - correct answer one working day
Travis, a computer forensics investigator, is finishing up a case he has been working on
for over a month involving copyright infringement and embezzlement. His last task is to
prepare an investigative report for the president of the company he has been working
for. Travis must submit a hard copy and an electronic copy to this president. In what
electronic format should travis send this report? - correct answer pdf
Harold is a computer forensics investigator working for a consulting firm out of atlanta
georgia. Harold is called upon to help with a corporate espionage case in miami florida.
Harold assists in the investigation by pulling all the data from the computer allegedly
used in the illegal activities. He find that two suspects in the company where stealing
sensitive corporate information and selling it to compete companies. From the email and
instant messager logs recovered, harold has discovered that the two employees notified
the buyers by writing symbols on the back of specific stop signs. This way, the buyers
knew when and where to meet with the alleged suspects to by the stolen material. What
type of steganography did these two suspects use? - correct answer visual semagram
An investigator is searching through the firewall logs of a company and notices icmp
packets that are larger than 65,538bytes. What type of activity is the investigator
seeing? - correct answer ping of death
What will the following command accomplish?
Dd if=/dev/xxx of=mbr.backup bs=512 count=1 - correct answer back up the master
boot record
What does the acronym post mean as it relates to a pc? - correct answer power on self
test
What is one method of bypassing a system bios password? - correct answer remove
the cmos battery
When searching through file headers for pictures file formats, what should be searched
to find a jpeg file in the hexadecimal format? - correct answer ff d8 ff e0 00 10
, What method of copying should always be performed first before carrying out an
investigation? - correct answer bit-stream copy
Heather, a computer forensics investigator, is assisting a group of investigators working
on a large computer fraud case involving over 20 people. These 20 people, working in
different offices, allegedly siphoned off money from many different client accounts.
Heather responsibility is to find out how the accused people communicated between
each other. She has searched their email and their computers and has not found any
useful evidence. Heather then finds some possibly useful evidence under the desk of
one of the accused.in an envelope she finds a piece of plastic with numerous holes cut
out of it. Heather then finds the same exact piece of plastic with holes at many of the
other accused peoples desks. Heather believes that the 20 people involved in the case
were using a cipher to send secret messages in between each other. What type of
cipher was used by the accused in this case? - correct answer grill cipher
What does encase search to recover ntfs files and folders? - correct answer mft
John is working on his company policies and guidelines. The section hie is currently
working on covers company documents, how they should be handled, stored and
eventually destroyed. John is concerned about the process where by outdated
document are destroyed. What type of shredder should john writ in the guidelines to be
used when destroying documents? - correct answer cross-cut shredder
Where is the default location for apache access logs on a linux computer? - correct
answer usr/local/apache/logs/access_log
What must be obtained before an investigation is carried out at a location? - correct
answer search warrant
Under confession, an accused criminal admitted to encrypting child pornography
pictures and then hiding them within other pictures. What technique did the accused
criminal employ? - correct answer steganography
Fully Solved Questions for Guaranteed Success
2025/2026
What must an investigator do before disconnecting an ipod from any type of computer?
- correct answer unmount the ipod
A picture file is recovered from a computer under investigation. During the investigation
process, the file is enlarged 500% to get a better view of its contents. The picture quality
is not degraded at all from this process. What kind of picture is this file. What kind of
picture is this file? - correct answer vector image
At what layer does a cross site scripting attack occur on? - correct answer application
What is the smallest physical storage unit on a hard drive? - correct answer sector
How many times can data be written on a dvd+r disk? - correct answer once
If a pda is seized in an investigation while the device is turned on, what would be the
proper procedure? - correct answer keep the device powered on
When carrying out a forensics investigation, why should you never delete a partition on
a dynamic disk? - correct answer the action can corrupt the disk
A forensics investigator is searching the hard drive of a computer for the files that were
recently moved t othe recycle bin. He searched for the file in the c:\recycled using a
command line tool but does not find anything. What is the reason for this? - correct
answer the files are hidden and he must use switch to view them.
The efforts to obtain information before a trial by demanding documents, depositions,
question and answers written under oath, written requests for admissions of fact, and
,examination of the scene is a description of what legal term? - correct answer
discovery
Which legal document allows law enforcement to search an office, place of business, or
other locale for evidence relating to an alleged crime? - correct answer search warrant
What happens when a file is deleted by a microsoft operating system using the fat file
system? - correct answer only the reference to the file is removed from the fat and can
be recovered.
What feature of decryption collection allows an investigator to crack a password as
quickly as possible? - correct answer distribute processing over 16 or fewer computers
Davidson trucking is a small transportation company that has three local offices in
detroit michigan. Ten female employees that work for the company have gone to an
attorney reporting that male employees repeatedly harassed them and that
management did nothing to stop the problem. Davidson has employee policies that
outline all company guidelines, including awareness on harassment and how it will not
be tolerated. When the case is brought to court, whom should the prosecuting attorney
call upon for not upholding company policy? - correct answer supervisors
To preserve digital evidence, an investigator should ____________________. - correct
answer make two copies of each evidence item using different imaging tools
Why should you never power on a computer that you need to acquire digital evidence
from? - correct answer when the computer boots up, files are written to the computer
rendering the data clean
To check for pop3 traffic using ethereal, what port should an investigator search by? -
correct answer 110
An on-site incident response team is called to investigate an alleged case of computer
tampering within their company. Before proceeding with the investigation, the ceo
,informs them that the incident will be classified as low level. How long will the team
have to respond to the incident? - correct answer one working day
Travis, a computer forensics investigator, is finishing up a case he has been working on
for over a month involving copyright infringement and embezzlement. His last task is to
prepare an investigative report for the president of the company he has been working
for. Travis must submit a hard copy and an electronic copy to this president. In what
electronic format should travis send this report? - correct answer pdf
Harold is a computer forensics investigator working for a consulting firm out of atlanta
georgia. Harold is called upon to help with a corporate espionage case in miami florida.
Harold assists in the investigation by pulling all the data from the computer allegedly
used in the illegal activities. He find that two suspects in the company where stealing
sensitive corporate information and selling it to compete companies. From the email and
instant messager logs recovered, harold has discovered that the two employees notified
the buyers by writing symbols on the back of specific stop signs. This way, the buyers
knew when and where to meet with the alleged suspects to by the stolen material. What
type of steganography did these two suspects use? - correct answer visual semagram
An investigator is searching through the firewall logs of a company and notices icmp
packets that are larger than 65,538bytes. What type of activity is the investigator
seeing? - correct answer ping of death
What will the following command accomplish?
Dd if=/dev/xxx of=mbr.backup bs=512 count=1 - correct answer back up the master
boot record
What does the acronym post mean as it relates to a pc? - correct answer power on self
test
What is one method of bypassing a system bios password? - correct answer remove
the cmos battery
When searching through file headers for pictures file formats, what should be searched
to find a jpeg file in the hexadecimal format? - correct answer ff d8 ff e0 00 10
, What method of copying should always be performed first before carrying out an
investigation? - correct answer bit-stream copy
Heather, a computer forensics investigator, is assisting a group of investigators working
on a large computer fraud case involving over 20 people. These 20 people, working in
different offices, allegedly siphoned off money from many different client accounts.
Heather responsibility is to find out how the accused people communicated between
each other. She has searched their email and their computers and has not found any
useful evidence. Heather then finds some possibly useful evidence under the desk of
one of the accused.in an envelope she finds a piece of plastic with numerous holes cut
out of it. Heather then finds the same exact piece of plastic with holes at many of the
other accused peoples desks. Heather believes that the 20 people involved in the case
were using a cipher to send secret messages in between each other. What type of
cipher was used by the accused in this case? - correct answer grill cipher
What does encase search to recover ntfs files and folders? - correct answer mft
John is working on his company policies and guidelines. The section hie is currently
working on covers company documents, how they should be handled, stored and
eventually destroyed. John is concerned about the process where by outdated
document are destroyed. What type of shredder should john writ in the guidelines to be
used when destroying documents? - correct answer cross-cut shredder
Where is the default location for apache access logs on a linux computer? - correct
answer usr/local/apache/logs/access_log
What must be obtained before an investigation is carried out at a location? - correct
answer search warrant
Under confession, an accused criminal admitted to encrypting child pornography
pictures and then hiding them within other pictures. What technique did the accused
criminal employ? - correct answer steganography
