WGU C702/ CHFI | Expert-Curated Practice Test Q&A:
Verified & Graded for Success 2025/2026
Us accreditation association for forensic laboratories. - correct answer ascld -american
association of crime lab directors
How many entrances should there be to a computer forensics laboratory? - correct
answer 1
In a computer forensics laboratory, how many computers should be budgeted per
examiner? - correct answer 2
Ufed - correct answer device for extracting data from mobile phones.
Tacc 1441 - correct answer device for cracking passwords using multiple gpu's.
What should be in place to ensure compliance with procedures and policies? - correct
answer routine audits
Nand -based flash memory - correct answer solid state memory (flash chips) that
retains memory without power
Scsi - correct answer small computer system interface.
Circuit board that handles up to 15 peripheral devices
How are tracks numbered? - correct answer cylinder, headnumber, sector
Sector - correct answer smallest physical storage unit.
512 bytes.
,Cluster - correct answer smallest allocation unit.
Set of tracks and sectors from 2 to 32.
Inimizes fragmentation
Slack space - correct answer free space on a cluster.
How many bytes per kilobyte? - correct answer 1024 bytes/kb
Lba number: - correct answer total number of sectors on a disk.
How do you calculate disk capacity? - correct answer c x h x s x (bytes/sector)
Master boot record (mbr - correct answer first sector of a data storage device.
(location, size, other important data)
What is the master boot record (mbr) used for? - correct answer holding a partition
table.
Bootstrapping an operating system.
32-bit disk signature (optional).
Bootstrapping - correct answer also called booting up.
Describes a computer when it is just turned on and initializes the operating system.
Which technology identifies attached devices as either master of slave devices? -
correct answer pata
(3 position cable:
One side attaches to the logic board
The other 2 attach to either
The slave device (center of cable)
,Or the master device (end of cable)
The area that is circumscribed 360 degrees on a platter of a disk,
When the read/ write head is in a single fixed position. - correct answer track
Areal density - correct answer number of bits per square inch on a hard disk platter.
Calculate disk capacity, in gigabytes, from lba. - correct answer lba * density / 1024/
Pata - correct answer technology that identifies attached devices as slave or master.
Slack space - correct answer the space that exists between the end of a file and the
end of the cluster.
Unused storage capacity.
Psfile command - correct answer lists and closes remotely opened files.
Openfiles command - correct answer displays open files.
Queries,
Displays, and
Disconnects files,
Netstat -ano option - correct answer displays tcp and udp connections.
Netstat -r option - correct answer displays routing table and persistent routes.
Pslist -x option - correct answer displays threads and memory used.
, Listdlls command - correct answer shows modules and dlls in use.
A tool & its parameters for seeing what dlls are referenced by an exe
Handle command - correct answer shows open files, ports, registry keys and threads.
Netstat -o - correct answer shows processid of the network connection process.
Fport - correct answer shows open tcp and udp ports
Promiscdetect - correct answer checks to see if nic is in promiscuous mode.
Promqry - correct answer determines active network interface status on remote
systems.
Doskey /history - correct answer shows previously typed commands.
Reg.exe - correct answer cmd tools for accessing and managing the registry
Ftk imager - correct answer tools to grab registry files.
Drivespy - correct answer tool used to collect slack space in a partition, into a file.
X-ways tool - correct answer tool used to scan virtual memory.
Swap file - correct answer the disk space that is set aside for virtual memory.
Hidden partition - correct answer logical section of disk space, which is not accessible
by the operating system.
Verified & Graded for Success 2025/2026
Us accreditation association for forensic laboratories. - correct answer ascld -american
association of crime lab directors
How many entrances should there be to a computer forensics laboratory? - correct
answer 1
In a computer forensics laboratory, how many computers should be budgeted per
examiner? - correct answer 2
Ufed - correct answer device for extracting data from mobile phones.
Tacc 1441 - correct answer device for cracking passwords using multiple gpu's.
What should be in place to ensure compliance with procedures and policies? - correct
answer routine audits
Nand -based flash memory - correct answer solid state memory (flash chips) that
retains memory without power
Scsi - correct answer small computer system interface.
Circuit board that handles up to 15 peripheral devices
How are tracks numbered? - correct answer cylinder, headnumber, sector
Sector - correct answer smallest physical storage unit.
512 bytes.
,Cluster - correct answer smallest allocation unit.
Set of tracks and sectors from 2 to 32.
Inimizes fragmentation
Slack space - correct answer free space on a cluster.
How many bytes per kilobyte? - correct answer 1024 bytes/kb
Lba number: - correct answer total number of sectors on a disk.
How do you calculate disk capacity? - correct answer c x h x s x (bytes/sector)
Master boot record (mbr - correct answer first sector of a data storage device.
(location, size, other important data)
What is the master boot record (mbr) used for? - correct answer holding a partition
table.
Bootstrapping an operating system.
32-bit disk signature (optional).
Bootstrapping - correct answer also called booting up.
Describes a computer when it is just turned on and initializes the operating system.
Which technology identifies attached devices as either master of slave devices? -
correct answer pata
(3 position cable:
One side attaches to the logic board
The other 2 attach to either
The slave device (center of cable)
,Or the master device (end of cable)
The area that is circumscribed 360 degrees on a platter of a disk,
When the read/ write head is in a single fixed position. - correct answer track
Areal density - correct answer number of bits per square inch on a hard disk platter.
Calculate disk capacity, in gigabytes, from lba. - correct answer lba * density / 1024/
Pata - correct answer technology that identifies attached devices as slave or master.
Slack space - correct answer the space that exists between the end of a file and the
end of the cluster.
Unused storage capacity.
Psfile command - correct answer lists and closes remotely opened files.
Openfiles command - correct answer displays open files.
Queries,
Displays, and
Disconnects files,
Netstat -ano option - correct answer displays tcp and udp connections.
Netstat -r option - correct answer displays routing table and persistent routes.
Pslist -x option - correct answer displays threads and memory used.
, Listdlls command - correct answer shows modules and dlls in use.
A tool & its parameters for seeing what dlls are referenced by an exe
Handle command - correct answer shows open files, ports, registry keys and threads.
Netstat -o - correct answer shows processid of the network connection process.
Fport - correct answer shows open tcp and udp ports
Promiscdetect - correct answer checks to see if nic is in promiscuous mode.
Promqry - correct answer determines active network interface status on remote
systems.
Doskey /history - correct answer shows previously typed commands.
Reg.exe - correct answer cmd tools for accessing and managing the registry
Ftk imager - correct answer tools to grab registry files.
Drivespy - correct answer tool used to collect slack space in a partition, into a file.
X-ways tool - correct answer tool used to scan virtual memory.
Swap file - correct answer the disk space that is set aside for virtual memory.
Hidden partition - correct answer logical section of disk space, which is not accessible
by the operating system.
