WGU C702 EXAM 2023 QUESTION AND ANSWERS

1. A software company suspects that employees have set up automatic cor- porate email forwarding to their personal inboxes against company policy. The company hires forensic investigators to identify the employees violating policy, with the intention of issuing warnings to them. Which type of cybercrime investigation approach is this company taking? Civil Criminal Administrative Punitive: Administrative 2. Which model or legislation applies a holistic approach toward any criminal activity as a criminal operation? Enterprise Theory of Investigation Racketeer Influenced and Corrupt Organizations Act Evidence Examination Law Enforcement Cyber Incident Reporting: Enterprise Theory of Investigation 3. What does a forensic investigator need to obtain before seizing a comput- ing device in a criminal case? Court warrant Completed crime report Chain of custody document Plaintiff's permission: Court warrant 4. Which activity should be used to check whether an application has ever been installed on a computer? Penetration test Risk analysis Log review Security review: Log review 5. Which characteristic describes an organization's forensic readiness in the context of cybercrimes? It includes moral considerations. It includes cost considerations. It excludes nontechnical actions. It excludes technical actions.: It includes cost considerations. 6. A cybercrime investigator identifies a Universal Serial Bus (USB) memory stick containing emails as a primary piece of evidence. Who must sign the chain of custody document once the USB stick is in evidence? Those who obtain access to the device Anyone who has ever used the device Recipients of emails on the device Authors of emails on the device: Those who obtain access to the device 7. Which type of attack is a denial-of-service technique that sends a large amount of data to overwhelm system resources? Phishing Spamming Mail bombing Bluejacking: Mail bombing 8. Which computer crime forensics step requires an investigator to duplicate and image the collected digital information? Securing evidence Acquiring data Analyzing data Assessing evidence: Acquiring data 9. What is the last step of a criminal investigation that requires the involve- ment of a computer forensic investigator? Analyzing the data collected Testifying in court Assessing the evidence Performing search and seizure: Testifying in court 10. How can a forensic investigator verify an Android mobile device is on, without potentially changing the original evidence or interacting with the operating system? Check to see if it is plugged into a computer Tap the screen multiple times Look for flashing lights Hold down the power button: Look for flashing lights 11. What should a forensic investigator use to protect a mobile device if a Faraday bag is not available? Aluminum foil Sturdy container Cardboard box Bubble wrap: Aluminum foil 12. Which criterion determines whether a technology used by government to obtain information in a computer search is considered innovative and requires a search warrant? Availability to the general public Dependency on third-party software Implementation based on open source software Use of cloud-based machine learning: Availability to the general public 13. Which situation allows a law enforcement officer to seize a hard drive from a residence without obtaining a search warrant? The computer is left unattended. The front door is wide open. The occupant is acting suspicious. The evidence is in imminent danger.: The evidence is in imminent danger. 14. Which legal document contains a summary of findings and is used to prosecute? Investigation report Search warrant Search and seizure Chain of custody: Investigation report 15. What should an investigator use to prevent any signals from reaching a mobile phone? Faraday bag Dry bag Anti-static container Lock box: Faraday bag 16. A forensic investigator is called to the stand as a technical witness in an internet payment fraud case. Which behavior is considered ethical by this investigator while testifying? Providing and explaining facts found during the investigation Interpreting the findings and offering a clear opinion to the jury Helping the jury arrive at a conclusion based on the facts Assisting the attorney in compiling a list of essential questions: Providing and explaining facts found during the investigation 17. A government agent is testifying in a case involving malware on a system. What should this agent have complied with during search and seizure? Fourth Amendment Stored Communications Act Net Neutrality Bill Federal Rules of Evidence: Fourth Amendment 18. Which method is used when an investigator has access to the plaintext and an image file with the hidden information? Stego-only Known-stego Known-message Chosen-message: Known-message 19. Which method is used when an investigator takes a plaintext message, uses various tools against it, and finds the algorithm used to hide informa- tion? Stego-only Known-stego Known-message Chosen-message: Chosen-message 20. Which operating system is targeted by the DaveGrohl password cracker? Linux OS X UNIX Windows: OS X 21. Which password cracker is used to recover passwords on an OS X operating system? Cain and Abel DaveGrohl L0phtCrack Ophcrack: DaveGrohl 22. Which tool allows a forensic investigator to process Transmission Con- trol Protocol (TCP) streams for analysis of malicious traffic? Kibana OSSEC Syslog-ng Wireshark: Wireshark 23. Which tool allows an investigator to review or process information in a Windows environment but does not rely on the Windows API? EnCase netstat dd LogMeister: EnCase 24. A computer forensic investigator finds an unauthorized wireless access point connected to an organization's network switch. This access point's wireless network has a random name with a hidden service set identifier (SSID). What is this set-up designed to do? Create a backdoor that a perpetrator can use by connecting wirelessly to the network Jam the wireless signals to stop all legitimate traffic from using the wireless network Activate the wireless cards in the laptops of victims to gain access to their data and network Transmit high-power signals that force users to connect to the rogue wire- less network: Create a backdoor that a perpetrator can use by connecting wire- lessly to the network 25. Which web-based application attack corrupts the execution stack of a web application? Buffer overflow Cookie poisoning SQL injection Denial-of-service: Buffer overflow 26. An employee is accused of sending a threatening email through Mi- crosoft Exchange. Which file extension should the investigator search for to find the archived message on the server? .DB .NSF .PST .EDB: .EDB 27. Investigators do not have physical access to the computer of the victim of an email crime. Which task should these investigators instruct the victim to perform in order to identify the sending email server? Provide the email body Provide the email header Run Aid4Mail Email Forensics Run Email Address Verifier: Provide the email header 28. Which tool should a forensic investigator use on a Windows computer to locate all the data on a computer disk, protect evidence, and create evidentiary reports for use in legal proceedings? Wireshark OmniPeek ProDiscover Capsa: ProDiscover 29. What is the purpose of hashing tools during data acquisition? Dumping the original RAM contents to a forensically sterile removable device Enabling write protection on the original media to preserve the original evidence Validating the collected digital evidence by comparing the original and copied file message digests Creating a replica of the original source to prevent the inadvertent alteration of the original: Validating the collected digital evidence by comparing the original and copied file message digests 30. Which software-based tool is used to prevent writes to storage devices on a computer? CRU WiebeTech ILook Investigator SAFE Block USB WriteBlocker: SAFE Block