WGU D431 DIGITAL FORENSICS IN
CYBERSECURITY EXAM 2026 SECURITY
FORENSICS ASSESSMENT FINAL PAPER
COMPREHENSIVE QUESTIONS AND ANSWERS
GRADED A+
◉ Software Forensics. Answer: The process of examining malicious
computer code; also called malware forensics
◉ Live System Forensics. Answer: The process of searching memory
in real time, typically for working with compromised hosts or to
identify system abuse.
◉ Extended data out dynamic random access memory (EDO DRAM).
Answer: Single-cycle EDO has the ability to carry out a complete
memory transaction in one clock cycle. Otherwise, each sequential
RAM access within the same page takes two clock cycles instead of
three, once the page has been selected.
◉ Asynchronous dynamic random access memory (ADRAM).
Answer: Not synchronized to the CPU clock
,◉ Synchronous dynamic random access memory (SDRAM). Answer:
A replacement for EDO
◉ Double data rate (DDR) SDRAM. Answer: Later development of
SDRAM
◉ Read-only memory (ROM). Answer: This is usually used for
instructions embedded in chips and controls how the computer,
option cards, peripherals, and other devices operate.
Cannot be changed
◉ Programmable read-only memory (PROM). Answer: Can be
programmed only once; data is not lost when power is removed.
◉ Erasable programmable read-only memory (EPROM). Answer:
Data is not lost when power is removed. Again, this is a technique for
storing instructions on chips.
◉ Electronically erasable programmable read-only memory
(EEPROM). Answer: This is how the instructions in your computer's
BIOS are stored.
,◉ Small Computer System Interface (SCSI). Answer: This has been
around for many years, and is particularly popular in high-end
servers. Must have a terminator at the end of the chain of devices to
work and are limited to 16 chained devices
◉ Integrated Drive Electronics (IDE). Answer: This is an older
standard but one that was commonly used on PCs for many years. It
is obvious you are dealing with this type of drive if you encounter a
40-pin connector on the drive.
◉ Parallel Advanced Technology Attachment (PATA). Answer: An
enhancement of IDE. It uses either a 40-pin (like IDE) or 80-pin
connector.
◉ Serial Advanced Technology Attachment (SATA). Answer: This is
what you are most likely to find today. These devices are commonly
found in workstations and many servers.
Does not have jumpers like IDE and EIDE
◉ Serial SCSI. Answer: An enhancement of SCSI that supports up to
65,537 devices and does not require termination.
◉ Solid-state drives. Answer: Use microchips that retain data in non-
volatile memory chips and contain no moving parts. Use NAND-
, based flash memory, which retains memory even without power.
Generally, require one-half to one-third the power of hard disk
drives
◉ Sector. Answer: The basic unit of data storage on a hard disk,
which is usually 512 bytes.
◉ Cluster. Answer: A logical grouping of sectors; can be 1 to 128
sectors in size; organized by tracks
◉ Drive Geometry. Answer: This term refers to the functional
dimensions of a drive-in terms of the number of heads, cylinders,
and sectors per track.
◉ Slack Space. Answer: This is the space between the end of a file
and the end of the cluster, assuming the file does not occupy the
entire cluster. This is space that can be used to hide data
◉ Low-level format. Answer: This creates a structure of sectors,
tracks, and clusters.
◉ High-level format. Answer: This is the process of setting up an
empty file system on the disk and installing a boot sector. This is
sometimes referred to as a quick format.
CYBERSECURITY EXAM 2026 SECURITY
FORENSICS ASSESSMENT FINAL PAPER
COMPREHENSIVE QUESTIONS AND ANSWERS
GRADED A+
◉ Software Forensics. Answer: The process of examining malicious
computer code; also called malware forensics
◉ Live System Forensics. Answer: The process of searching memory
in real time, typically for working with compromised hosts or to
identify system abuse.
◉ Extended data out dynamic random access memory (EDO DRAM).
Answer: Single-cycle EDO has the ability to carry out a complete
memory transaction in one clock cycle. Otherwise, each sequential
RAM access within the same page takes two clock cycles instead of
three, once the page has been selected.
◉ Asynchronous dynamic random access memory (ADRAM).
Answer: Not synchronized to the CPU clock
,◉ Synchronous dynamic random access memory (SDRAM). Answer:
A replacement for EDO
◉ Double data rate (DDR) SDRAM. Answer: Later development of
SDRAM
◉ Read-only memory (ROM). Answer: This is usually used for
instructions embedded in chips and controls how the computer,
option cards, peripherals, and other devices operate.
Cannot be changed
◉ Programmable read-only memory (PROM). Answer: Can be
programmed only once; data is not lost when power is removed.
◉ Erasable programmable read-only memory (EPROM). Answer:
Data is not lost when power is removed. Again, this is a technique for
storing instructions on chips.
◉ Electronically erasable programmable read-only memory
(EEPROM). Answer: This is how the instructions in your computer's
BIOS are stored.
,◉ Small Computer System Interface (SCSI). Answer: This has been
around for many years, and is particularly popular in high-end
servers. Must have a terminator at the end of the chain of devices to
work and are limited to 16 chained devices
◉ Integrated Drive Electronics (IDE). Answer: This is an older
standard but one that was commonly used on PCs for many years. It
is obvious you are dealing with this type of drive if you encounter a
40-pin connector on the drive.
◉ Parallel Advanced Technology Attachment (PATA). Answer: An
enhancement of IDE. It uses either a 40-pin (like IDE) or 80-pin
connector.
◉ Serial Advanced Technology Attachment (SATA). Answer: This is
what you are most likely to find today. These devices are commonly
found in workstations and many servers.
Does not have jumpers like IDE and EIDE
◉ Serial SCSI. Answer: An enhancement of SCSI that supports up to
65,537 devices and does not require termination.
◉ Solid-state drives. Answer: Use microchips that retain data in non-
volatile memory chips and contain no moving parts. Use NAND-
, based flash memory, which retains memory even without power.
Generally, require one-half to one-third the power of hard disk
drives
◉ Sector. Answer: The basic unit of data storage on a hard disk,
which is usually 512 bytes.
◉ Cluster. Answer: A logical grouping of sectors; can be 1 to 128
sectors in size; organized by tracks
◉ Drive Geometry. Answer: This term refers to the functional
dimensions of a drive-in terms of the number of heads, cylinders,
and sectors per track.
◉ Slack Space. Answer: This is the space between the end of a file
and the end of the cluster, assuming the file does not occupy the
entire cluster. This is space that can be used to hide data
◉ Low-level format. Answer: This creates a structure of sectors,
tracks, and clusters.
◉ High-level format. Answer: This is the process of setting up an
empty file system on the disk and installing a boot sector. This is
sometimes referred to as a quick format.
