Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

Digital-Forensics-in-Cybersecurity Digital Forensics in Cybersecurity (D431/C840) Course

  • WGU
  • 5 free sample questions

About this exam

Digital-Forensics-in-Cybersecurity is the WGU exam Digital Forensics in Cybersecurity (D431/C840) Course. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
Digital-Forensics-in-Cybersecurity
Vendor
WGU
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for Digital-Forensics-in-Cybersecurity.

Question 1

Susan was looking at her credit report and noticed that several new credit cards had been opened
lately in her name. Susan has not opened any of the credit card accounts herself.
Which type of cybercrime has been perpetrated against Susan?

  1. Option A:
    Identity theft
  2. Option B:
    SQL injection
  3. Option C:
    Cyberstalking
  4. Option D:
    Malware
Show answer and explanation

Correct answer: A

Comprehensive and Detailed Explanation From Exact Extract:
Identity theft occurs when an attacker unlawfully obtains and uses another person's personal
information to open accounts, access credit, or commit fraud. The opening of credit cards without
the victim's consent is a classic example. SQL injection is a web application attack method that does not directly relate to this case.
Cyberstalking involves harassment via digital means and is unrelated.
Malware is malicious software and may be used to facilitate identity theft but is not the crime itself.
Reference:
According to the U.S. Federal Trade Commission (FTC) definitions and NIST Cybersecurity Framework,
identity theft is defined as the unauthorized use of someone’s personal information for fraudulent
purposes, perfectly matching Susan’s situation.

Question 2

A cybercriminal hacked into an Apple iPad that belongs to a company's chief executive officer (CEO).
The cybercriminal deleted some important files on the data volume that must be retrieved.
Which hidden folder will contain the digital evidence.?

  1. Option A:
    /Private/etc
  2. Option B:
    /lost+found
  3. Option C:
    /.Trashes/501
  4. Option D:
    /etc
Show answer and explanation

Correct answer: C

Comprehensive and Detailed Explanation From Exact Extract:
On Apple iOS devices, deleted files are often moved to a hidden Trash folder before permanent
deletion. The directory /.Trashes/501 is a hidden folder where deleted files for user ID 501 (the first
user created on macOS/iOS devices) are temporarily stored.
This folder can contain files marked for deletion and thus is a prime location for recovery attempts.
/lost+found is a directory commonly used on Unix/Linux file systems for recovered file fragments
after file system corruption but is not the default trash location on iOS.
/Private/etc and /etc contain system configuration files, not deleted user files.
Reference:
Apple forensic investigations per NIST and training manuals such as those from Cellebrite and
BlackBag Technologies indicate that user-deleted files on iOS devices reside in .Trashes or similar
hidden directories until permanently removed.
See all 5 free sample questions