Important WGU (D431/C840) Digital Forensics in Cybersecurity Course Exam Questions

Answer: A

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

The CAN-SPAM Act requires that commercial emails include a clear and conspicuous mechanism allowing recipients to opt out of receiving future emails. This opt-out method cannot require payment or additional steps that would discourage recipients.

The act aims to reduce unsolicited commercial emails and spam.

Compliance is critical for lawful email marketing and forensic investigations involving email misuse.

Answer: B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

Disconnecting the computer from the network by unplugging the Ethernet cable prevents further spread of malware and stops external communication that could lead to data exfiltration. This containment step is vital before further evidence collection.

Maintaining system power preserves volatile memory.

Network disconnection is recommended by incident response guidelines.

NIST SP 800-61 recommends isolating affected systems from networks early in incident response.

Answer: B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

The .bash_history file located in each user's home directory (e.g., /Users/<user>/.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user.

/var/vm contains virtual memory swap files, not command history.

/var/log contains system logs but not individual user shell command history.

/Users/<user>/Library/Preferences stores application preferences.

NIST guidelines and macOS forensics literature confirm .bash_history as the standard location for shell command histories on OS X systems.

Answer: C

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

Forensic Toolkit (FTK) is a widely recognized and trusted software suite in digital forensics used to acquire and analyze forensic images of devices, including mobile phones. FTK supports the creation of bit-by-bit images of digital evidence, ensuring the integrity and admissibility of the evidence in legal contexts. This imaging process is crucial in preserving the original state of the device data without alteration.

FTK enables forensic investigators to perform logical and physical acquisitions of mobile devices.

It maintains the integrity of the evidence by generating cryptographic hash values (MD5, SHA-1) to prove that the image is an exact copy.

Other options such as PTFinder or Forensic SIM Cloner focus on specific tasks like SIM card cloning or targeted data extraction but do not provide full forensic imaging capabilities.

Data Doctor is more aligned with data recovery rather than forensic imaging.

According to standard digital forensics methodologies outlined by NIST Special Publication 800-101 (Guidelines on Mobile Device Forensics) and the SANS Institute Digital Forensics and Incident Response guides, forensic tools used to acquire mobile device images must be capable of bit-stream copying with hash verification, which FTK provides.

Answer: B

Explanation:

Comprehensive and Detailed Explanation From Exact Extract:

NIST Special Publication 800-72 provides guidelines for mobile device forensics and identifies four device states during data extraction: active, idle, powered off, and locked. These states influence how data can be accessed and preserved.

Understanding these states helps forensic investigators select appropriate acquisition techniques.

NIST SP 800-72 is a key reference for mobile device forensic methodologies.

NIST SP 800-72 offers authoritative guidelines on handling mobile device data in forensic investigations.