WGU C702
WGU C702 Exam Questions with
Correct Detailed Answers 2026
1
Computer Forensics
A set of methodological procedures and techniques that help identify, gather, preserve,
extract, interpret, document, and present evidence from computers in a way that is legally
admissible
2
Cyber Crime
Any illegal act involving a computing device, network, its systems, or its applications. Both
internal and external
3
Enterprise Theory of Investigation (ETI)
Methodology for investigating criminal activity
4
Types of Cyber Crime
Civil, Criminal, Administrative
5
Civil Cases
Involve disputes between two parties. Brought for violation of contracts and lawsuits where
a guilty outcome generally results in monetary damages to the plaintiff
6
Criminal Cases
Brought by law enforcement agencies in response to a suspected violation of law where a
guilty outcome results in monetary damages, imprisonment, or both
7
Administrative Cases
An internal investigation by an organization to discover if its employees/clients/partners
are abiding by the rules or policies (Violation of company policies). Non-criminal in nature
and are related to misconduct or activities of an employee
8
Rules of Forensic Investigation
Safeguard the integrity of the evidence and render it acceptable in a court of law. The
forensic examiner must make duplicate copies of the original evidence. The duplicate
copies must be accurate replications of the originals, and the forensic examiner must also
authenticate the duplicate copies to avoid questions about the integrity of the evidence.
WGU C702
,WGU C702
Must not continue with the investigation if the examination is going to be beyond his or her
knowledge level or skill level.
9
Cyber Crime Investigation Methodology/Steps
1.Identify the computer crime 2.Collect preliminary evidence 3.Obtain court warrant dor
discovery/seizure of evidence 4.Perform first responder procedures 5.Seize evidence at the
crime scene 6. Transport evidence to lab 7.Create two bitstream copies of the evidence 8.
Generate MD5 checksum of the s 9. Maintain chain of custody 10. Store original evidence
in secure location 11. Analyze the copy for evidence 12. Prepare a forensic report 13.
Submit a report to client 14. Testify in course as an expert witness
10
Locard's Exchange Principle
Anyone of anything, entering a crime scene takes something of the scene with them and
leaves something of themselves behind when they leave.
11
Types of Digital Data
Volatile Data
Non-volatile Data
12
Volatile Data
Temporary information on a device that requires a constant power supply and is deleted if
the power supply is interrupted
13
Non-Volatile Data
Secondary storage of data. Long-term, persistent data.
Permanent data stored on secondary storage devices, such as hard disks and memory
cards.
14
Characteristics of Digital Evidence
1. Be Relevant
2. Be probative
3. Be authentic
4. Be accurate
5. Be complete
6. Be convincing
7. Be admissible
15
Admissible evidence
Evidence that can be legally and properly introduced in a civil or criminal trial.
WGU C702
, WGU C702
Evidence is relevant to the case
16
Authentic Evidence
Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy,
and integrity of the evidence
17
Complete Evidence
Evidence must either prove or disprove the fact
18
Reliable Evidence
evidence that possesses a sufficient degree of likelihood that it is true and accurate
Evidence must be proven dependable when the evidence was extracted
19
Believable Evidence
Evidence must be presented in a clear manner and expert opinions must be obtained where
necessary
20
Rules of Evidence
Rules governing the admissibility of evidence in trial courts.
21
Best Evidence Rule
states that secondary evidence, or a copy, is inadmissible in court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
22
Forensic Readiness
An organization's ability to make optimal use of digital evidence in a limited period and
with minimal investigation costs.
23
Fourth Amendment
Protects against unreasonable search and seizure. Government agents may not search or
seize areas or things in which a person has reasonable expectation of privacy, without a
search warrant.
24
WGU C702
WGU C702 Exam Questions with
Correct Detailed Answers 2026
1
Computer Forensics
A set of methodological procedures and techniques that help identify, gather, preserve,
extract, interpret, document, and present evidence from computers in a way that is legally
admissible
2
Cyber Crime
Any illegal act involving a computing device, network, its systems, or its applications. Both
internal and external
3
Enterprise Theory of Investigation (ETI)
Methodology for investigating criminal activity
4
Types of Cyber Crime
Civil, Criminal, Administrative
5
Civil Cases
Involve disputes between two parties. Brought for violation of contracts and lawsuits where
a guilty outcome generally results in monetary damages to the plaintiff
6
Criminal Cases
Brought by law enforcement agencies in response to a suspected violation of law where a
guilty outcome results in monetary damages, imprisonment, or both
7
Administrative Cases
An internal investigation by an organization to discover if its employees/clients/partners
are abiding by the rules or policies (Violation of company policies). Non-criminal in nature
and are related to misconduct or activities of an employee
8
Rules of Forensic Investigation
Safeguard the integrity of the evidence and render it acceptable in a court of law. The
forensic examiner must make duplicate copies of the original evidence. The duplicate
copies must be accurate replications of the originals, and the forensic examiner must also
authenticate the duplicate copies to avoid questions about the integrity of the evidence.
WGU C702
,WGU C702
Must not continue with the investigation if the examination is going to be beyond his or her
knowledge level or skill level.
9
Cyber Crime Investigation Methodology/Steps
1.Identify the computer crime 2.Collect preliminary evidence 3.Obtain court warrant dor
discovery/seizure of evidence 4.Perform first responder procedures 5.Seize evidence at the
crime scene 6. Transport evidence to lab 7.Create two bitstream copies of the evidence 8.
Generate MD5 checksum of the s 9. Maintain chain of custody 10. Store original evidence
in secure location 11. Analyze the copy for evidence 12. Prepare a forensic report 13.
Submit a report to client 14. Testify in course as an expert witness
10
Locard's Exchange Principle
Anyone of anything, entering a crime scene takes something of the scene with them and
leaves something of themselves behind when they leave.
11
Types of Digital Data
Volatile Data
Non-volatile Data
12
Volatile Data
Temporary information on a device that requires a constant power supply and is deleted if
the power supply is interrupted
13
Non-Volatile Data
Secondary storage of data. Long-term, persistent data.
Permanent data stored on secondary storage devices, such as hard disks and memory
cards.
14
Characteristics of Digital Evidence
1. Be Relevant
2. Be probative
3. Be authentic
4. Be accurate
5. Be complete
6. Be convincing
7. Be admissible
15
Admissible evidence
Evidence that can be legally and properly introduced in a civil or criminal trial.
WGU C702
, WGU C702
Evidence is relevant to the case
16
Authentic Evidence
Evidence that is in its original or genuine state.
Investigators must provide supporting documents regarding the authenticity, accuracy,
and integrity of the evidence
17
Complete Evidence
Evidence must either prove or disprove the fact
18
Reliable Evidence
evidence that possesses a sufficient degree of likelihood that it is true and accurate
Evidence must be proven dependable when the evidence was extracted
19
Believable Evidence
Evidence must be presented in a clear manner and expert opinions must be obtained where
necessary
20
Rules of Evidence
Rules governing the admissibility of evidence in trial courts.
21
Best Evidence Rule
states that secondary evidence, or a copy, is inadmissible in court when the original exists.
Duplicate evidence will suffice under the following conditions:
-Original evidence is destroyed due to fire or flood
-Original evidence is destroyed in the normal course of business
-Original evidence is in possession of a third party
22
Forensic Readiness
An organization's ability to make optimal use of digital evidence in a limited period and
with minimal investigation costs.
23
Fourth Amendment
Protects against unreasonable search and seizure. Government agents may not search or
seize areas or things in which a person has reasonable expectation of privacy, without a
search warrant.
24
WGU C702
