Get WGU (D431/C840) Digital Forensics in Cybersecurity Course Exam Practice Questions - Real and Updated

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

On 64-bit versions of Windows operating systems (including Windows 7), 32-bit applications are installed by default into the folder C:\Program Files (x86). This separation allows the OS to distinguish between 64-bit and 32-bit applications and apply appropriate system calls and redirection.

C:\Program Files is reserved for native 64-bit applications.

C:\ProgramData contains application data shared across users.

C:\Windows contains system files, not program installations.

This structure is documented in Microsoft Windows Internals and Windows Forensics guides, including official NIST guidelines on Windows forensic investigations.

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

Title 18 U.S.C. 2252B addresses the criminal offense of using misleading domain names with the intent to deceive minors into accessing harmful material. This law specifically targets online behavior designed to exploit or expose minors to inappropriate content.

It is part of broader child protection statutes.

Enforcement requires digital evidence linking domain misuse to the intent.

Federal statutes and legal frameworks on cybercrime emphasize the applicability of 18 U.S.C. 2252B in prosecuting online deception aimed at minors.

Answer : A

Comprehensive and Detailed Explanation From Exact Extract:

When collecting evidence from a running system, volatile and critical evidence such as security logs should be collected first as they are most susceptible to being overwritten or lost. Security logs may contain valuable information on unauthorized access or malicious activity.

Chat room logs, recently accessed files, and temporary internet files are important but often less volatile or can be recovered from disk later.

NIST SP 800-86 and SANS Incident Response Guidelines prioritize the collection of volatile logs and memory contents first.

This approach helps ensure preservation of time-sensitive data critical for forensic analysis.

Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

The /Library/Receipts folder on Mac OS X contains receipts that track software installation and updates, including system and application updates. This folder helps forensic investigators determine which updates were installed and when, useful for detecting suspicious or unauthorized software installations like spyware.

/var/spool/cups is related to printer spooling.

/var/log/daily.out contains daily system log summaries but not detailed update records.

/var/vm contains virtual memory files.

NIST and Apple forensics documentation indicate that /Library/Receipts is a key location for examining software installation history.

Answer : B

Comprehensive and Detailed Explanation From Exact Extract:

The browser cache stores recently accessed web pages, images, and cookies, which may include phishing site content and related activity. Investigators analyzing phishing attacks collect browser cache data to reconstruct the victim's web activity and detect malicious sites.

Cached web pages help corroborate victim statements and establish timelines.

Browser history and cache are volatile and must be preserved promptly.

According to NIST SP 800-101 and forensic guides, browser cache is critical in investigating phishing and web-based attacks.