1 of 18
WGU C702 OA 2025/2026 FINAL EXAM LATEST VERSION REAL 250
EXAM QUESTIONS AND CORRECT ANSWERS | VERIFIED
ANSWERS||BRAND NEW VERSION!!
A chain of custody is a critical document in the computer forensics investigation process
because the document provides legal validation of appropriate evidence handling.
- ......ANSWER........True.
Identify the following which was launched by the National Institute of Standards and
Technology (NIST), that establishes a "methodology for testing computer forensics
software tools by development of general tool specifications, test procedures, test criteria,
test sets, and test hardware." - ......ANSWER........Computer Forensic Tool Testing Project
(CFTTP)
Which of the following is NOT a digital data storage type? - ......ANSWER........Quantum
storage devices.
Which of the following is NOT a common computer file system? - ......ANSWER........EFX3
Which field type refers to the volume descriptor as a primary? - ......ANSWER........Number
1
Which logical drive holds the information regarding the data and files that are stored in the
disk? - ......ANSWER........Extended partition.
How large is the partition table structure that stores information about the partitions
present on the hard disk? - ......ANSWER........64-byte.
How many bits are used by the MBR partition scheme for storing LBAs (Logical Block
Addresses) and the size information on a 512-byte sector? - ......ANSWER........32 bits
in the GUID Partition Table, which Logical Block Address contains the Partition Entry Array?
- ......ANSWER........LBA 2
Which of the following describes when the user restarts the system via the operating
system? - ......ANSWER........Warm booting.
Which Windows operating system power on and starts up using either the traditional BIOS-
MBR method or the newer UEFI-GPT method? - ......ANSWER........Windows 8.
,2 of 18
Which item describes the following UEFI boot process phase? The phase of EFI consisting
of initializing the CPU, temporary memory, and boot firmware volume (BFV); locating and
executing the chapters to initialize all the found hardware in the system; and creating a
Hand-Off Block List with all found resources interface descriptors. - ......ANSWER........PEI
(Pre-EFI Initialization) Phase.
Which of the following basic partitioning tools displays details about the GPT partition
tables in Windows OS? - ......ANSWER........Disk Part.
What stage of the Linux boot process includes the task of loading the Linux kernel and
optional initial RAM disk? - ......ANSWER........Bootloader Stage
What component of a typical FAT32 file system consists of data that the document
framework uses to get to the volume and utilizes the framework parcel to stack the working
portion documents? - ......ANSWER........Boot Sector.
Which component of the NTFS architecture is a computer system file driver for NTFS?
- ......ANSWER........Ntfs.sys
What is the name of the abstract layer that resides on top of a complete file system, allows
client application to access various file systems, and consists of a dispatching layer and
numerous caches? - ......ANSWER........Virtual File System (VFS)
Which information held by the superblock contains major and minor items that allow the
mounting code to determine whether supported features are available to the file system?
- ......ANSWER........Revision Level.
Which file system used in Linux was developed by Stephen Tweedie in 2001 as a journaling
file system that improves reliability of the system? - ......ANSWER........Ext3
How many bit values does HFS use to address allocation blocks? - ......ANSWER........16
What UFS file system part is composed of a few blocks in the partition reserved at the
beginning? - ......ANSWER........Boot blocks.
What is a machine-readable language used in major digital operations, such as sending
and receiving emails? - ......ANSWER........ASCII
What is JPEG an acronym of? - ......ANSWER........Joint Photographic Experts Group
, 3 of 18
What is the proprietary Microsoft Office presentation file extension used in PowerPoint?
- ......ANSWER........PPT
Which of the following is an example of optical media? - ......ANSWER........CD/DVD
In sector, addressing _______ determines the address of the individual sector on the disk.
- ......ANSWER........Cylinders, Heads, and Sectors (CHS)
______ is a 128-bit unique reference number used as an identifier in computer software?
- ......ANSWER........Global Unique Identifier (GUID)
Mac OS uses a hierarchical file system. - ......ANSWER........True.
The main advantage of RAID is that if a single physical disk fails: - ......ANSWER........The
system will continue to function without loss of data.
The command "fsstat" displays the details associated with an image file.
- ......ANSWER........False.
What is the simplest RAID level that does not involve redundancy, and fragments the file
into the user-defined stripe size of the array? - ......ANSWER........RAID 0
An investigator may commit some common mistakes while collecting data from the
system that result in the loss of critical evidence. Which of the following is NOT a mistake
that investigators commonly make? - ......ANSWER........Use of correct cables and cabling
techniques.
In Linux Standard Tools, forensic investigators use the following build-in Linux Commands
to copy data from a disk drive: - ......ANSWER........dd and dcfldd
Because they are always changing, the information in the registers or the processor cache
are the most volatile data. - ......ANSWER........True.
Forensic data duplication involves the creation of a file that has every bit of information
from the source in a raw bit-stream format. - ......ANSWER........True.
What document is used as a written record consisting of all processes involved in seizure,
custody, control, transfer, analysis, and disposition of physical or electronic evidence?
- ......ANSWER........Chain of custody document.
What is the process of permanently deleting or destroying data from storage media?
- ......ANSWER........Media sanitization.
WGU C702 OA 2025/2026 FINAL EXAM LATEST VERSION REAL 250
EXAM QUESTIONS AND CORRECT ANSWERS | VERIFIED
ANSWERS||BRAND NEW VERSION!!
A chain of custody is a critical document in the computer forensics investigation process
because the document provides legal validation of appropriate evidence handling.
- ......ANSWER........True.
Identify the following which was launched by the National Institute of Standards and
Technology (NIST), that establishes a "methodology for testing computer forensics
software tools by development of general tool specifications, test procedures, test criteria,
test sets, and test hardware." - ......ANSWER........Computer Forensic Tool Testing Project
(CFTTP)
Which of the following is NOT a digital data storage type? - ......ANSWER........Quantum
storage devices.
Which of the following is NOT a common computer file system? - ......ANSWER........EFX3
Which field type refers to the volume descriptor as a primary? - ......ANSWER........Number
1
Which logical drive holds the information regarding the data and files that are stored in the
disk? - ......ANSWER........Extended partition.
How large is the partition table structure that stores information about the partitions
present on the hard disk? - ......ANSWER........64-byte.
How many bits are used by the MBR partition scheme for storing LBAs (Logical Block
Addresses) and the size information on a 512-byte sector? - ......ANSWER........32 bits
in the GUID Partition Table, which Logical Block Address contains the Partition Entry Array?
- ......ANSWER........LBA 2
Which of the following describes when the user restarts the system via the operating
system? - ......ANSWER........Warm booting.
Which Windows operating system power on and starts up using either the traditional BIOS-
MBR method or the newer UEFI-GPT method? - ......ANSWER........Windows 8.
,2 of 18
Which item describes the following UEFI boot process phase? The phase of EFI consisting
of initializing the CPU, temporary memory, and boot firmware volume (BFV); locating and
executing the chapters to initialize all the found hardware in the system; and creating a
Hand-Off Block List with all found resources interface descriptors. - ......ANSWER........PEI
(Pre-EFI Initialization) Phase.
Which of the following basic partitioning tools displays details about the GPT partition
tables in Windows OS? - ......ANSWER........Disk Part.
What stage of the Linux boot process includes the task of loading the Linux kernel and
optional initial RAM disk? - ......ANSWER........Bootloader Stage
What component of a typical FAT32 file system consists of data that the document
framework uses to get to the volume and utilizes the framework parcel to stack the working
portion documents? - ......ANSWER........Boot Sector.
Which component of the NTFS architecture is a computer system file driver for NTFS?
- ......ANSWER........Ntfs.sys
What is the name of the abstract layer that resides on top of a complete file system, allows
client application to access various file systems, and consists of a dispatching layer and
numerous caches? - ......ANSWER........Virtual File System (VFS)
Which information held by the superblock contains major and minor items that allow the
mounting code to determine whether supported features are available to the file system?
- ......ANSWER........Revision Level.
Which file system used in Linux was developed by Stephen Tweedie in 2001 as a journaling
file system that improves reliability of the system? - ......ANSWER........Ext3
How many bit values does HFS use to address allocation blocks? - ......ANSWER........16
What UFS file system part is composed of a few blocks in the partition reserved at the
beginning? - ......ANSWER........Boot blocks.
What is a machine-readable language used in major digital operations, such as sending
and receiving emails? - ......ANSWER........ASCII
What is JPEG an acronym of? - ......ANSWER........Joint Photographic Experts Group
, 3 of 18
What is the proprietary Microsoft Office presentation file extension used in PowerPoint?
- ......ANSWER........PPT
Which of the following is an example of optical media? - ......ANSWER........CD/DVD
In sector, addressing _______ determines the address of the individual sector on the disk.
- ......ANSWER........Cylinders, Heads, and Sectors (CHS)
______ is a 128-bit unique reference number used as an identifier in computer software?
- ......ANSWER........Global Unique Identifier (GUID)
Mac OS uses a hierarchical file system. - ......ANSWER........True.
The main advantage of RAID is that if a single physical disk fails: - ......ANSWER........The
system will continue to function without loss of data.
The command "fsstat" displays the details associated with an image file.
- ......ANSWER........False.
What is the simplest RAID level that does not involve redundancy, and fragments the file
into the user-defined stripe size of the array? - ......ANSWER........RAID 0
An investigator may commit some common mistakes while collecting data from the
system that result in the loss of critical evidence. Which of the following is NOT a mistake
that investigators commonly make? - ......ANSWER........Use of correct cables and cabling
techniques.
In Linux Standard Tools, forensic investigators use the following build-in Linux Commands
to copy data from a disk drive: - ......ANSWER........dd and dcfldd
Because they are always changing, the information in the registers or the processor cache
are the most volatile data. - ......ANSWER........True.
Forensic data duplication involves the creation of a file that has every bit of information
from the source in a raw bit-stream format. - ......ANSWER........True.
What document is used as a written record consisting of all processes involved in seizure,
custody, control, transfer, analysis, and disposition of physical or electronic evidence?
- ......ANSWER........Chain of custody document.
What is the process of permanently deleting or destroying data from storage media?
- ......ANSWER........Media sanitization.
