トップクラスWGU Digital-Forensics-in-Cybersecurityオンライン問題集で更新された[2025年12月]
Digital-Forensics-in-Cybersecurity練習問題集で検証済みのFast2test更新された82問題あります
質問 # 29
An organization is determined to prevent data leakage through steganography. It has developed a workflow that all outgoing data must pass through. The company will implement a tool as part of the workflow to check for hidden data.
Which tool should be used to check for the existence of steganographically hidden data?
- A. Snow
- B. Forensic Toolkit (FTK)
- C. Data Doctor
- D. MP3Stego
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Snow is a specialized steganalysis tool that detects and extracts hidden data encoded in whitespace characters within text files and other mediums. It is widely used in digital forensic investigations for detecting covert data hiding methods such as whitespace steganography.
* Data Doctor is a general data recovery tool, not specialized in steganalysis.
* FTK is a general forensic suite, not specifically designed for steganography detection.
* MP3Stego is focused on audio steganography.
NIST and digital forensics literature recognize Snow as a valuable tool in workflows designed to detect hidden data in text or similar carriers.
質問 # 30
A forensic specialist is about to collect digital evidence from a suspect's computer hard drive. The computer is off.
What should be the specialist's first step?
- A. Turn the computer on and remove any malware.
- B. Make a forensic copy of the computer's hard drive.
- C. Turn the computer on and photograph the desktop.
- D. Carefully review the chain of custody form.
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Before any action on evidence, especially when seizing or processing digital devices, the forensic specialist must first carefully review and document the chain of custody (CoC) to ensure proper handling and legal compliance. This includes verifying seizure procedures and documenting the status of the device before any interaction.
* Turning the computer on prematurely risks altering or destroying volatile data.
* Making a forensic copy (imaging) can only happen after proper documentation and preservation steps.
* Photographing the desktop is relevant only after power-on but only if approved and documented.
This process aligns with NIST guidelines (SP 800-86) and the Scientific Working Group on Digital Evidence (SWGDE) principles emphasizing preservation and documentation as foundational steps.
質問 # 31
What is a reason to use steganography?
- A. To delete secret data
- B. To highlight secret data
- C. To erase secret data
- D. To save secret data
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Steganography is used to save or embed secret data within another file or medium, allowing covert communication without alerting observers to the presence of the data.
* The goal is to conceal, not highlight or delete data.
* It does not erase or delete secret data; instead, it hides it.
This aligns with standard definitions in cybersecurity and forensic literature including NIST's cybersecurity frameworks.
質問 # 32
Which Windows component is responsible for reading the boot.ini file and displaying the boot loader menu on Windows XP during the boot process?
- A. NTLDR
- B. Winload.exe
- C. BOOTMGR
- D. BCD
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
NTLDR (NT Loader) is the boot loader for Windows NT-based systems including Windows XP. It reads the boot.ini configuration file and displays the boot menu, initiating the boot process.
* Later Windows versions (Vista and above) replaced NTLDR with BOOTMGR.
* Understanding boot components assists forensic investigators in boot process analysis.
Reference:Microsoft technical documentation and forensic training materials outline NTLDR's role in legacy Windows systems.
質問 # 33
Which tool identifies the presence of steganography?
- A. DiskDigger
- B. Disk Investigator
- C. Forensic Toolkit (FTK)
- D. ComputerCOP
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Disk Investigator is a forensic tool that can analyze disk images and file systems to identify hidden data, including the presence of steganography by examining slack space, hidden files, and embedded data.
* DiskDigger is mainly a data recovery tool.
* FTK is a comprehensive forensic suite but does not specialize in steganography detection.
* ComputerCOP is a parental control software, not a forensic tool.
Digital forensic best practices recognize Disk Investigator as useful for detecting steganographic content in files and disk areas.
質問 # 34
How is the Windows swap file, also known as page file, used?
- A. Reserved for system files
- B. Replaces bad sectors
- C. Augments the RAM
- D. Primarily for security
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Windows swap file, or page file, is a system file used to extend physical memory by storing data that cannot fit into the RAM. When RAM is full, the OS swaps inactive data pages to this file, thus augmenting RAM capacity.
* It does not replace bad sectors; that function is for disk management utilities.
* It is not primarily for security but for memory management.
* It is not reserved exclusively for system files but is used dynamically for memory paging.
Reference:Microsoft's official documentation and forensic guides like NIST SP 800-86 describe the page file' s role in virtual memory management and its importance in forensic analysis because it may contain fragments of memory and sensitive information.
質問 # 35
An organization has identified a system breach and has collected volatile data from the system.
Which evidence type should be collected next?
- A. File timestamps
- B. Running processes
- C. Temporary data
- D. Network connections
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
In incident response, after collecting volatile data (such as contents of RAM), the next priority is often to collect network-related evidence such as active network connections. Network connections can reveal ongoing communications, attacker activity, command and control channels, or data exfiltration paths.
* Running processes and temporary data are also volatile but typically collected simultaneously or immediately after volatile memory.
* File timestamps relate to non-volatile data and are collected later after volatile data acquisition to preserve evidence integrity.
* This sequence is supported by NIST SP 800-86 and SANS Incident Handler's Handbook which emphasize the volatility of evidence and recommend capturing network state immediately after memory.
質問 # 36
Which Windows component is responsible for reading the boot.ini file and displaying the boot loader menu on Windows XP during the boot process?
- A. NTLDR
- B. Winload.exe
- C. BOOTMGR
- D. BCD
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
NTLDR (NT Loader) is the boot loader for Windows NT-based systems including Windows XP. It reads the boot.ini configuration file and displays the boot menu, initiating the boot process.
* Later Windows versions (Vista and above) replaced NTLDR with BOOTMGR.
* Understanding boot components assists forensic investigators in boot process analysis.
Reference:Microsoft technical documentation and forensic training materials outline NTLDR's role in legacy Windows systems.
質問 # 37
Which file stores local Windows passwords in the Windows\System32\ directory and is subject to being cracked by using a live CD?
- A. HAL
- B. Ntidr
- C. SAM
- D. IPSec
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The SAM (Security Account Manager) file located in theWindows\System32\configdirectory stores hashed local user account passwords. It can be accessed and extracted using a live CD or bootable forensic tool, which allows the forensic investigator to bypass the running operating system and avoid altering the evidence.
* IPSec is related to network security policies, not password storage.
* HAL (Hardware Abstraction Layer) is a system file managing hardware interaction.
* Ntidr is a boot loader file in Windows NT systems.
Cracking password hashes extracted from the SAM file is a common forensic practice to recover user passwords during investigations.
Reference:NIST Special Publication 800-86 and Windows forensic textbooks confirm that the SAM file is the repository of local password hashes accessible via forensic live CDs or imaging.
質問 # 38
How should a forensic scientist obtain the network configuration from a Windows PC before seizing it from a crime scene?
- A. By opening the Network and Sharing Center
- B. By using the ipconfig command from a command prompt on the computer
- C. By rebooting the computer into safe mode
- D. By checking the system properties
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The ipconfig command executed at a Windows command prompt displays detailed network configuration information such as IP addresses, subnet masks, and default gateways. Collecting this information prior to seizure preserves volatile evidence relevant to the investigation.
* Documenting network settings supports the understanding of the suspect system's connectivity at the time of seizure.
* NIST recommends capturing volatile data (including network configuration) before shutting down or disconnecting a suspect machine.
Reference:NIST SP 800-86 and forensic best practices recommend gathering volatile evidence using system commands like ipconfig.
質問 # 39
The chief information security officer of a company believes that an attacker has infiltrated the company's network and is using steganography to communicate with external sources. A security team is investigating the incident. They are told to start by focusing on the core elements of steganography.
What are the core elements of steganography?
- A. Encryption, decryption, key
- B. File, metadata, header
- C. Hash, nonce, salt
- D. Payload, carrier, channel
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The core elements of steganography include:
* Payload: the hidden data or message,
* Carrier: the medium (e.g., image, audio file) containing the payload,
* Channel: the method or path used to deliver the carrier with the payload embedded.
* Understanding these elements helps investigators detect and analyze steganographic content.
Reference:NIST SP 800-101 and steganography research identify these core components as fundamental to steganographic communication.
質問 # 40
Which type of storage format should be transported in a special bag to reduce electrostatic interference?
- A. Flash drives
- B. Solid-state drives
- C. Optical discs
- D. Magnetic media
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Magnetic media such as hard drives and magnetic tapes are sensitive to electrostatic discharge (ESD), which can damage data. They must be transported in anti-static bags or containers to reduce the risk of electrostatic interference.
* SSDs and flash drives are less vulnerable to ESD but still benefit from proper packaging.
* Proper handling protocols prevent unintentional data loss or corruption.
Reference:NIST SP 800-101 and forensic evidence handling standards specify anti-static packaging for magnetic storage media.
質問 # 41
Which characteristic applies to solid-state drives (SSDs) compared to magnetic drives?
- A. They are less susceptible to damage
- B. They are generally slower
- C. They have a lower cost per gigabyte
- D. They have moving parts
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Solid-state drives (SSDs) use flash memory and have no moving mechanical parts, making them more resistant to physical shock and damage compared to magnetic drives, which rely on spinning platters.
* This resilience makes SSDs favorable in environments with higher physical risk.
* However, data recovery from SSDs can be more complex due to wear-leveling and TRIM features.
Reference:NIST and forensic hardware guides highlight SSD durability advantages over traditional magnetic storage.
質問 # 42
Which technique allows a cybercriminal to hide information?
- A. Cryptography
- B. Encryption
- C. Steganography
- D. Steganalysis
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Steganography is the technique of hiding information within another file, message, image, or medium to conceal the existence of the information itself. It differs from encryption in that the data is hidden, not just scrambled.
* Steganalysis is the detection or analysis of hidden data.
* Encryption and cryptography involve scrambling data but do not inherently hide its existence.
NIST and digital forensics guidelines define steganography as the art of concealed writing or data hiding, used by criminals to evade detection.
質問 # 43
Which method of copying digital evidence ensures proper evidence collection?
- A. Bit-level copy
- B. Cloud backup
- C. Encrypted transfer
- D. File-level copy
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A bit-level (bitstream) copy creates an exact sector-by-sector duplicate of the original media, capturing all files, deleted data, and slack space. This method is essential to preserve the entirety of digital evidence without modification.
* Bit-level imaging maintains forensic soundness.
* It allows investigators to perform analysis without altering original data.
Reference:NIST SP 800-86 and digital forensics best practices emphasize bit-level copying for evidence acquisition.
質問 # 44
The chief information officer of an accounting firm believes sensitive data is being exposed on the local network.
Which tool should the IT staff use to gather digital evidence about this security vulnerability?
- A. Firewall
- B. Sniffer
- C. Packet filter
- D. Antivirus
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
A sniffer, also known as a packet analyzer, captures network traffic in real time and allows IT staff to monitor and analyze data packets passing through the network. This is crucial when investigating potential data leaks or network vulnerabilities. Using a sniffer helps identify unauthorized transmissions of sensitive data and trace suspicious activity at the packet level.
* Sniffers collect raw network data which can be analyzed for patterns or anomalies.
* According to NIST guidelines on network forensics, packet capture tools (sniffers) are essential in gathering digital evidence related to network security incidents.
Reference:NIST Special Publication 800-86 (Guide to Integrating Forensic Techniques into Incident Response) highlights the importance of sniffers in network-based investigations.
質問 # 45
How do forensic specialists show that digital evidence was handled in a protected, secure manner during the process of collecting and analyzing the evidence?
- A. By performing backups
- B. By deleting temporary files
- C. By encrypting all evidence
- D. By maintaining the chain of custody
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The chain of custody is a documented, chronological record detailing the seizure, custody, control, transfer, analysis, and disposition of evidence. Maintaining this record proves that the evidence was protected and unaltered, which is essential for court admissibility.
* Each transfer or access must be logged with date, time, and handler.
* Breaks in the chain can compromise the legal validity of evidence.
Reference:According to NIST and forensic best practices, the chain of custody documentation is mandatory for reliable evidence handling.
質問 # 46
Which U.S. law protects journalists from turning over their work or sources to law enforcement before the information is shared with the public?
- A. Communications Assistance to Law Enforcement Act (CALEA)
- B. Health Insurance Portability and Accountability Act (HIPAA)
- C. The Privacy Protection Act (PPA)
- D. Electronic Communications Privacy Act (ECPA)
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Privacy Protection Act (PPA) protects journalists by restricting law enforcement's ability to search or seize materials intended for public dissemination unless certain exceptions apply. It safeguards journalistic sources and unpublished work from unwarranted government intrusion.
* The PPA ensures freedom of the press and protects confidential information.
* Law enforcement must comply with procedural safeguards before accessing journalistic materials.
Reference:Legal texts and digital forensic guidelines note the PPA's role in balancing investigative needs with press freedoms.
質問 # 47
A forensics investigator is investigating a Windows computer which may be collecting data from other computers on the network.
Which Windows command line tool can be used to determine connections between machines?
- A. Openfiles
- B. Netstat
- C. Telnet
- D. Xdetect
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Netstatis a standard Windows command line utility that displays active network connections, routing tables, and network interface statistics. It is widely used in forensic investigations to identify current and past TCP/IP connections, including IP addresses and port numbers associated with remote hosts. This information helps investigators identify if the suspect computer has active connections to other machines potentially used for data collection or command and control.
* Telnet is a protocol used to connect to remote machines but does not display current network connections.
* Openfiles shows files opened remotely but not network connection details.
* Xdetect is not a standard Windows tool and not recognized in forensic investigations.
Reference:According to NIST SP 800-86 and SANS Digital Forensics guidelines,netstatis an essential tool for gathering network-related evidence during system investigations.
質問 # 48
Where does Windows store passwords for local user accounts?
- A. Security file in Windows\System32
- B. SAM file in Windows\System32
- C. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
- D. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Windows stores the hashes of local user account passwords in the SAM (Security Account Manager) file, which is located in theWindows\System32\configdirectory. This file is a critical component in the Windows security infrastructure.
* The registry paths in A and B refer to network profiles and wireless configuration data, unrelated to password storage.
* The "Security" file also resides in theSystem32\configfolder but stores security policy data rather than password hashes.
* The SAM file stores password hashes and is targeted in forensic investigations for credential recovery.
Reference:Microsoft technical documentation and NIST digital forensics standards explain that the SAM file is the definitive source for local user password hashes in Windows systems.
質問 # 49
Which tool can be used to make a bit-by-bit copy of a Windows Phone 8?
- A. Wolf
- B. Data Doctor
- C. Forensic Toolkit (FTK)
- D. Pwnage
正解：C
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Forensic Toolkit (FTK) is a comprehensive forensic suite capable of acquiring bit-by-bit images from various devices, including Windows Phone 8, by supporting physical and logical extractions. FTK is widely accepted and used for mobile device forensic imaging.
* Data Doctor is primarily a data recovery tool, not specialized for mobile forensic imaging.
* Pwnage is related to jailbreaking iOS devices.
* Wolf is not a recognized forensic imaging tool for Windows Phone 8.
NIST mobile device forensic standards cite FTK as a preferred tool for mobile device imaging.
質問 # 50
Which law requires both parties to consent to the recording of a conversation?
- A. Electronic Communications Privacy Act (ECPA)
- B. Wiretap Act
- C. Health Insurance Portability and Accountability Act (HIPAA)
- D. Stored Communications Act
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Electronic Communications Privacy Act (ECPA) regulates interception and recording of electronic communications and generally requires the consent of both parties involved in a conversation for legal recordings.
* This consent requirement protects privacy rights during investigations.
* Non-compliance can lead to evidence being inadmissible or legal penalties.
Reference:ECPA provisions are detailed in legal frameworks governing digital privacy and forensics.
質問 # 51
......
最新（2025)WGU Digital-Forensics-in-Cybersecurity試験問題集：https://jp.fast2test.com/Digital-Forensics-in-Cybersecurity-premium-file.html
更新されたDigital-Forensics-in-Cybersecurity試験問題集でPDF問題とテストエンジン：https://drive.google.com/open?id=1A7PqWPsAX2uw5okSGFDhODVEJojo8zOE