WGU Digital Forensics in Cybersecurity Dumps (V8.02): Good Study Resources for Starting Your WGU Digital Forensics in Cybersecurity Exam Course

1. An organization has identified a system breach and has collected volatile data from the system.

Which evidence type should be collected next?

2. A forensic scientist is examining a computer for possible evidence of a cybercrime.

Why should the forensic scientist copy files at the bit level instead of the OS level when copying files from the computer to a forensic computer?

3. Which operating system creates a swap file to temporarily store information from memory on the hard drive when needed?

4. A cybercriminal hacked into an Apple iPad that belongs to a company's chief executive officer (CEO).

The cybercriminal deleted some important files on the data volume that must be retrieved.

Which hidden folder will contain the digital evidence?

5. A forensic investigator needs to know which file type to look for in order to find emails from a specific client.

Which file extension is used by Eudora?

6. Where does Windows store passwords for local user accounts?

7. A forensic investigator needs to identify where email messages are stored on a Microsoft Exchange server.

Which file extension is used by Exchange email servers to store the mailbox database?

8. A forensic investigator wants to collect evidence from a file created by a Macintosh computer running OS X 10.8.

Which file type can be created by this OS?

9. 1.An organization believes that a company-owned mobile phone has been compromised.

Which software should be used to collect an image of the phone as digital evidence?

10. A forensic investigator suspects that spyware has been installed to a Mac OS X computer by way of an update.

Which Mac OS X log or folder stores information about system and software updates?

11. Which description applies to the Advanced Forensic Format (AFF)?

12. A victim of Internet fraud fell for an online offer after using a search engine to find a deal on an expensive software purchase. Once the victim learned about the fraud, he contacted a forensic investigator for help.

Which digital evidence should the investigator collect?

13. A company has identified that a hacker has modified files on one of the company's computers. The IT department has collected the storage media from the hacked computer.

Which evidence should be obtained from the storage media to identify which files were modified?

14. A digital forensic examiner receives a computer used in a hacking case. The examiner is asked to extract information from the computer's Registry.

How should the examiner proceed when obtaining the requested digital evidence?

15. Which type of information does a Windows SAM file contain?

16. Which directory contains the system's configuration files on a computer running Mac OS X?

17. A forensic specialist is about to collect digital evidence from a suspect's computer hard drive. The computer is off.

What should be the specialist's first step?

18. Where is the default location for 32-bit programs installed by a user on a 64-bit version of Windows 7?

19. Which Windows 7 operating system log stores events collected from remote computers?

20. Which information is included in an email header?

21. Susan was looking at her credit report and noticed that several new credit cards had been opened lately in her name. Susan has not opened any of the credit card accounts herself.

Which type of cybercrime has been perpetrated against Susan?

22. A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts.

Which log file or folder should be reviewed?

23. A USB flash drive was seized as evidence to be entered into a trial.

Which type of evidence is this USB flash drive?

24. Which term describes the used space between the end of a file and the end of the last cluster assigned to the file?

25. An employee sends an email message to a fellow employee. The message is sent through the company's messaging server.

Which protocol is used to send the email message?

26. Which principle of evidence collection states that access to evidence must be tracked from the time it is seized through its use in court?

27. How is the Windows swap file, also known as page file, used?

28. A forensics investigator is investigating a Windows computer which may be collecting data from other computers on the network.

Which Windows command line tool can be used to determine connections between machines?

29. Which storage format is a magnetic drive?

30. Which file stores local Windows passwords in the WindowsSystem32 directory and is subject to being cracked by using a live CD?