Free WGU Digital-Forensics-in-Cybersecurity Practice Exam with Questions & Answers | Set: 2

Comprehensive and Detailed Explanation From Exact Extract:

The Windows swap file, or page file, is a system file used to extend physical memory by storing data that cannot fit into the RAM. When RAM is full, the OS swaps inactive data pages to this file, thus augmenting RAM capacity.

It does not replace bad sectors; that function is for disk management utilities.

It is not primarily for security but for memory management.

It is not reserved exclusively for system files but is used dynamically for memory paging.

Comprehensive and Detailed Explanation From Exact Extract:

On 64-bit versions of Windows operating systems (including Windows 7), 32-bit applications are installed by default into the folderC:\Program Files (x86). This separation allows the OS to distinguish between 64-bit and 32-bit applications and apply appropriate system calls and redirection.

C:\Program Filesis reserved for native 64-bit applications.

C:\ProgramDatacontains application data shared across users.

C:\Windowscontains system files, not program installations.

This structure is documented in Microsoft Windows Internals and Windows Forensics guides, including official NIST guidelines on Windows forensic investigations.

Comprehensive and Detailed Explanation From Exact Extract:

In incident response, after collecting volatile data (such as contents of RAM), the next priority is often to collect network-related evidence such as active network connections. Network connections can reveal ongoing communications, attacker activity, command and control channels, or data exfiltration paths.

Running processes and temporary data are also volatile but typically collected simultaneously or immediately after volatile memory.

File timestamps relate to non-volatile data and are collected later after volatile data acquisition to preserve evidence integrity.

This sequence is supported by NIST SP 800-86 and SANS Incident Handler’s Handbook which emphasize the volatility of evidence and recommend capturing network state immediately after memory.

Comprehensive and Detailed Explanation From Exact Extract:

Magnetic media such as hard drives and magnetic tapes are sensitive to electrostatic discharge (ESD), which can damage data. They must be transported in anti-static bags or containers to reduce the risk of electrostatic interference.

SSDs and flash drives are less vulnerable to ESD but still benefit from proper packaging.

Proper handling protocols prevent unintentional data loss or corruption.

Comprehensive and Detailed Explanation From Exact Extract:

The Privacy Protection Act (PPA) protects journalists by restricting law enforcement’s ability to search or seize materials intended for public dissemination unless certain exceptions apply. It safeguards journalistic sources and unpublished work from unwarranted government intrusion.

The PPA ensures freedom of the press and protects confidential information.

Law enforcement must comply with procedural safeguards before accessing journalistic materials.

Comprehensive and Detailed Explanation From Exact Extract:

The ipconfig command executed at a Windows command prompt displays detailed network configuration information such as IP addresses, subnet masks, and default gateways. Collecting this information prior to seizure preserves volatile evidence relevant to the investigation.

Documenting network settings supports the understanding of the suspect system's connectivity at the time of seizure.

NIST recommends capturing volatile data (including network configuration) before shutting down or disconnecting a suspect machine.

Comprehensive and Detailed Explanation From Exact Extract:

A sniffer, also known as a packet analyzer, captures network traffic in real time and allows IT staff to monitor and analyze data packets passing through the network. This is crucial when investigating potential data leaks or network vulnerabilities. Using a sniffer helps identify unauthorized transmissions of sensitive data and trace suspicious activity at the packet level.

Sniffers collect raw network data which can be analyzed for patterns or anomalies.

According to NIST guidelines on network forensics, packet capture tools (sniffers) are essential in gathering digital evidence related to network security incidents.

Comprehensive and Detailed Explanation From Exact Extract:

Netstatis a command-line network utility tool used to monitor active network connections, open ports, and network routing tables. In the context of detecting data exfiltration potentially using steganographic methods, netstat can help a forensic investigator identify suspicious or unauthorized network connections through which hidden data may be leaving an organization.

While netstat itself does not detect steganography within files, it can be used to monitor data flows and connections to external hosts, which is critical for identifying channels where steganographically hidden data could be transmitted.

Data Encryption Standard (DES)is a cryptographic algorithm, not a forensic tool.

MP3Stegois a steganography tool for embedding data in MP3 files and is not designed for detection or monitoring.

Forensic Toolkit (FTK)is a forensic analysis software focused on acquiring and analyzing data from storage devices, not network monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

The CAN-SPAM Act requires that commercial emails include a clear and conspicuous mechanism allowing recipients to opt out of receiving future emails. This opt-out method cannot require payment or additional steps that would discourage recipients.

The act aims to reduce unsolicited commercial emails and spam.

Compliance is critical for lawful email marketing and forensic investigations involving email misuse.

Comprehensive and Detailed Explanation From Exact Extract:

Title 18 U.S.C. § 2252B addresses the criminal offense of using misleading domain names with the intent to deceive minors into accessing harmful material. This law specifically targets online behavior designed to exploit or expose minors to inappropriate content.

It is part of broader child protection statutes.

Enforcement requires digital evidence linking domain misuse to the intent.