C840: Digital Forensics in Cybersecurity Pre-
Assessment, D431 Digital Forensics, WGU D431 - LAWS,
WGU D431 - Digital Forensics in Cybersecurity, D431 -
Laws
Thomas received an email stating that he needed to follow a link
and verify his bank account information to ensure it was secure.
Shortly after following the instructions, Thomas noticed money was
missing from his account.
Which digital evidence should be considered to determine how
Thomas' account information was compromised?
Email messages
The chief executive officer (CEO) of a small computer company
has identified a potential hacking attack from an outside
competitor.
Which type of evidence should a forensics investigator use to
identify the source of the hack?
Network transaction logs
,A forensic scientist arrives at a crime scene to begin collecting
evidence. What is the first thing the forensic scientist should do?
Photograph all evidence in its original place
Which method of copying digital evidence ensures proper
evidence collection?
Make the copy at the bit-level
A computer involved in a crime is infected with malware. The
computer is on and connected to the company's network. The
forensic investigator arrives at the scene.
Which action should be the investigator's first step?
Unplug the computer's Ethernet cable
What are the three basic tasks that a systems forensic specialist must
keep in mind when handling evidence during a cybercrime
investigation?
Find evidence, Preserve evidence, and Prepare evidence
,How do forensic specialists show that digital evidence was
handled in a protected, secure manner during the process of
collecting and analyzing the evidence?
Chain of custody
Which characteristic applies to magnetic drives compared to solid-
state drives (SSDs)?
Lower cost
Which characteristic applies to solid-state drives (SSDs) compared to
magnetic drives?
They are less susceptible to damage.
Which type of storage format should be transported in a special
bag to reduce electrostatic interference?
Magnetic media
Which Windows component is responsible for reading the
boot.ini file and displaying the boot loader menu on Windows XP
during the boot process?
NTLDR
, The following line of code is an example of how to make a
forensic copy of a suspect drive:
dd if=/dev/mem of=/evidence/image.memory1
Which operating system should be used to run this command?
Linux
Which file system is supported by Mac?
Hierarchical File System Plus (HFS+)
Which law requires both parties to consent to the recording of a
conversation?
Electronic Communications Privacy Act (ECPA)
Which law is related to the disclosure of personally identifiable
protected health information (PHI)?
Health Insurance Portability and Accountability Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a misleading
domain name with the intent to deceive a minor into viewing
harmful material?
18 U.S.C. 2252B
Assessment, D431 Digital Forensics, WGU D431 - LAWS,
WGU D431 - Digital Forensics in Cybersecurity, D431 -
Laws
Thomas received an email stating that he needed to follow a link
and verify his bank account information to ensure it was secure.
Shortly after following the instructions, Thomas noticed money was
missing from his account.
Which digital evidence should be considered to determine how
Thomas' account information was compromised?
Email messages
The chief executive officer (CEO) of a small computer company
has identified a potential hacking attack from an outside
competitor.
Which type of evidence should a forensics investigator use to
identify the source of the hack?
Network transaction logs
,A forensic scientist arrives at a crime scene to begin collecting
evidence. What is the first thing the forensic scientist should do?
Photograph all evidence in its original place
Which method of copying digital evidence ensures proper
evidence collection?
Make the copy at the bit-level
A computer involved in a crime is infected with malware. The
computer is on and connected to the company's network. The
forensic investigator arrives at the scene.
Which action should be the investigator's first step?
Unplug the computer's Ethernet cable
What are the three basic tasks that a systems forensic specialist must
keep in mind when handling evidence during a cybercrime
investigation?
Find evidence, Preserve evidence, and Prepare evidence
,How do forensic specialists show that digital evidence was
handled in a protected, secure manner during the process of
collecting and analyzing the evidence?
Chain of custody
Which characteristic applies to magnetic drives compared to solid-
state drives (SSDs)?
Lower cost
Which characteristic applies to solid-state drives (SSDs) compared to
magnetic drives?
They are less susceptible to damage.
Which type of storage format should be transported in a special
bag to reduce electrostatic interference?
Magnetic media
Which Windows component is responsible for reading the
boot.ini file and displaying the boot loader menu on Windows XP
during the boot process?
NTLDR
, The following line of code is an example of how to make a
forensic copy of a suspect drive:
dd if=/dev/mem of=/evidence/image.memory1
Which operating system should be used to run this command?
Linux
Which file system is supported by Mac?
Hierarchical File System Plus (HFS+)
Which law requires both parties to consent to the recording of a
conversation?
Electronic Communications Privacy Act (ECPA)
Which law is related to the disclosure of personally identifiable
protected health information (PHI)?
Health Insurance Portability and Accountability Act (HIPAA)
Which U.S. law criminalizes the act of knowingly using a misleading
domain name with the intent to deceive a minor into viewing
harmful material?
18 U.S.C. 2252B
