WGU Digital Forensics in Cybersecurity (D829) Exam Questions Instant Access

Question 1

Which term describes the used space between the end of a file and the end of the last cluster assigned to the file?

AUnallocated space

BVolume slack

CHost protected area

DFile slack

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

File slack is the space between the logical end of a file and the physical end of the last cluster allocated to the file. This space may contain residual data from previously deleted files or fragments, making it significant in forensic investigations.

Unallocated space refers to clusters not currently assigned to any file.

Volume slack includes slack space at the volume level but is less specific.

Host protected area is a reserved part of the disk for system use, unrelated to slack space.

File slack is a recognized forensic artifact often examined for hidden data or remnants.

This concept is extensively described in forensic textbooks and NIST publications on file systems, including SP 800-86 and SWGDE best practices.

Question 2

A forensic investigator wants to collect evidence from a file created by a Macintosh computer running OS X 10.8.

Which file type can be created by this OS?

AReiserFS

BMFS

CHFS+

DNTFS

Answer : C

Comprehensive and Detailed Explanation From Exact Extract:

Mac OS X 10.8 (Mountain Lion) uses the HFS+ (Hierarchical File System Plus) file system by default for its native storage volumes. HFS+ is Apple's proprietary file system introduced in the late 1990s, designed for macOS.

ReiserFS is a Linux file system.

MFS (Macintosh File System) is an outdated file system replaced by HFS.

NTFS is a Windows file system.

This is well documented in Apple technical specifications and forensic analysis standards for macOS systems.

Digital forensics references including NIST guidelines and vendor documentation confirm HFS+ as the standard file system for Mac OS X versions prior to APFS adoption.

Question 3

Which type of information does a Windows SAM file contain?

AHash of network passwords

BEncrypted network passwords

CHash of local Windows passwords

DEncrypted local Windows passwords

Answer : C

Comprehensive and Detailed Explanation From Exact Extract:

The Windows Security Account Manager (SAM) file stores hashed passwords for local Windows user accounts. These hashes are used to authenticate users without storing plaintext passwords.

The SAM file stores local account password hashes, not network passwords.

Passwords are hashed (not encrypted) using algorithms like NTLM or LM hashes.

Network password management occurs elsewhere (e.g., Active Directory).

NIST SP 800-86 and standard Windows forensics texts explain that the SAM file contains hashed local account credentials critical for forensic investigations involving Windows systems.

Question 4

Which U.S. law criminalizes the act of knowingly using a misleading domain name with the intent to deceive a minor into viewing harmful material?

ACommunications Assistance to Law Enforcement Act (CALEA)

B18 U.S.C. 2252B

CThe Privacy Protection Act (PPA)

DElectronic Communications Privacy Act (ECPA)

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

Title 18 U.S.C. 2252B addresses the criminal offense of using misleading domain names with the intent to deceive minors into accessing harmful material. This law specifically targets online behavior designed to exploit or expose minors to inappropriate content.

It is part of broader child protection statutes.

Enforcement requires digital evidence linking domain misuse to the intent.

Federal statutes and legal frameworks on cybercrime emphasize the applicability of 18 U.S.C. 2252B in prosecuting online deception aimed at minors.

Question 5

A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts.

Which log file or folder should be reviewed?

A/var/vm

B/Users/<user>/.bash_history

C/var/log

D/Users/<user>/Library/Preferences

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

The .bash_history file located in each user's home directory (e.g., /Users/<user>/.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user.

/var/vm contains virtual memory swap files, not command history.

/var/log contains system logs but not individual user shell command history.

/Users/<user>/Library/Preferences stores application preferences.

NIST guidelines and macOS forensics literature confirm .bash_history as the standard location for shell command histories on OS X systems.

Question 6

A forensic specialist is about to collect digital evidence from a suspect's computer hard drive. The computer is off.

What should be the specialist's first step?

ACarefully review the chain of custody form.

BTurn the computer on and remove any malware.

CMake a forensic copy of the computer's hard drive.

DTurn the computer on and photograph the desktop.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

Before any action on evidence, especially when seizing or processing digital devices, the forensic specialist must first carefully review and document the chain of custody (CoC) to ensure proper handling and legal compliance. This includes verifying seizure procedures and documenting the status of the device before any interaction.

Turning the computer on prematurely risks altering or destroying volatile data.

Making a forensic copy (imaging) can only happen after proper documentation and preservation steps.

Photographing the desktop is relevant only after power-on but only if approved and documented.

This process aligns with NIST guidelines (SP 800-86) and the Scientific Working Group on Digital Evidence (SWGDE) principles emphasizing preservation and documentation as foundational steps.

Question 7

A forensic investigator suspects that spyware has been installed to a Mac OS X computer by way of an update.

Which Mac OS X log or folder stores information about system and software updates?

A/var/spool/cups

B/var/log/daily.out

C/var/vm

D/Library/Receipts

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

The /Library/Receipts folder on Mac OS X contains receipts that track software installation and updates, including system and application updates. This folder helps forensic investigators determine which updates were installed and when, useful for detecting suspicious or unauthorized software installations like spyware.

/var/spool/cups is related to printer spooling.

/var/log/daily.out contains daily system log summaries but not detailed update records.

/var/vm contains virtual memory files.

NIST and Apple forensics documentation indicate that /Library/Receipts is a key location for examining software installation history.