[2026年更新]早速ゲットしてトップランクのWGU Digital-Forensics-in-Cybersecurity試験問題集
パスする秘訣はDigital-Forensics-in-Cybersecurityをゲットして認証された試験エンジンPDF
質問 # 19
The human resources manager of a small accounting firm believes he may have been a victim of a phishing scam. The manager clicked on a link in an email message that asked him to verify the logon credentials for the firm's online bank account.
Which digital evidence should a forensic investigator collect to investigate this incident?
- A. System logs
- B. Browser cache
- C. Email headers
- D. Network traffic logs
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The browser cache stores recently accessed web pages, images, and cookies, which may include phishing site content and related activity. Investigators analyzing phishing attacks collect browser cache data to reconstruct the victim's web activity and detect malicious sites.
* Cached web pages help corroborate victim statements and establish timelines.
* Browser history and cache are volatile and must be preserved promptly.
Reference:According to NIST SP 800-101 and forensic guides, browser cache is critical in investigating phishing and web-based attacks.
質問 # 20
A cybercriminal communicates with his compatriots using steganography. The FBI discovers that the criminal group uses white space to hide data in photographs.
Which tool can the cybercriminals use to facilitate this type of communication?
- A. Steganophony
- B. Snow
- C. QuickStego
- D. Wolf
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Snow is a tool that encodes hidden messages using whitespace characters (spaces and tabs), which can be embedded in text and sometimes in image file metadata or formats that allow invisible characters. It is commonly used to hide data in plain sight, including within digital images.
* Steganophony focuses on hiding data in VoIP.
* Wolf is not recognized as a steganography tool for whitespace.
* QuickStego is another tool for text-based steganography but less commonly associated with whitespace specifically.
Forensic and cybersecurity literature often cites Snow as the preferred tool for whitespace-based steganography.
質問 # 21
Which U.S. law protects journalists from turning over their work or sources to law enforcement before the information is shared with the public?
- A. Communications Assistance to Law Enforcement Act (CALEA)
- B. The Privacy Protection Act (PPA)
- C. Health Insurance Portability and Accountability Act (HIPAA)
- D. Electronic Communications Privacy Act (ECPA)
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Privacy Protection Act (PPA) protects journalists by restricting law enforcement's ability to search or seize materials intended for public dissemination unless certain exceptions apply. It safeguards journalistic sources and unpublished work from unwarranted government intrusion.
* The PPA ensures freedom of the press and protects confidential information.
* Law enforcement must comply with procedural safeguards before accessing journalistic materials.
Reference:Legal texts and digital forensic guidelines note the PPA's role in balancing investigative needs with press freedoms.
質問 # 22
Which law or guideline lists the four states a mobile device can be in when data is extracted from it?
- A. NIST SP 800-72 Guidelines
- B. Communications Assistance to Law Enforcement Act (CALEA)
- C. Health Insurance Portability and Accountability Act (HIPAA)
- D. Electronic Communications Privacy Act (ECPA)
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
NIST Special Publication 800-72 provides guidelines for mobile device forensics and identifies four device states during data extraction: active, idle, powered off, and locked. These states influence how data can be accessed and preserved.
* Understanding these states helps forensic investigators select appropriate acquisition techniques.
* NIST SP 800-72 is a key reference for mobile device forensic methodologies.
Reference:NIST SP 800-72 offers authoritative guidelines on handling mobile device data in forensic investigations.
質問 # 23
Which method is used to implement steganography through pictures?
- A. Metadata alteration
- B. Least Significant Bit (LSB) insertion
- C. File compression
- D. Encrypting image pixels
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Least Significant Bit (LSB) insertion involves modifying the least significant bits of image pixel data to embed hidden information. Changes are imperceptible to the human eye, making this a common steganographic technique.
* LSB insertion is widely studied and targeted in steganalysis.
* It allows covert data embedding without increasing file size significantly.
Reference:Forensic and anti-forensics manuals reference LSB as a standard image steganography method.
質問 # 24
A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts.
Which log file or folder should be reviewed?
- A. /var/log
- B. /var/vm
- C. /Users/<user>/Library/Preferences
- D. /Users/<user>/.bash_history
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The.bash_historyfile located in each user's home directory (e.g.,/Users/<user>/.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user.
* /var/vmcontains virtual memory swap files, not command history.
* /var/logcontains system logs but not individual user shell command history.
* /Users/<user>/Library/Preferencesstores application preferences.
NIST guidelines and macOS forensics literature confirm.bash_historyas the standard location for shell command histories on OS X systems.
質問 # 25
How is the Windows swap file, also known as page file, used?
- A. Augments the RAM
- B. Primarily for security
- C. Reserved for system files
- D. Replaces bad sectors
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Windows swap file, or page file, is a system file used to extend physical memory by storing data that cannot fit into the RAM. When RAM is full, the OS swaps inactive data pages to this file, thus augmenting RAM capacity.
* It does not replace bad sectors; that function is for disk management utilities.
* It is not primarily for security but for memory management.
* It is not reserved exclusively for system files but is used dynamically for memory paging.
Reference:Microsoft's official documentation and forensic guides like NIST SP 800-86 describe the page file' s role in virtual memory management and its importance in forensic analysis because it may contain fragments of memory and sensitive information.
質問 # 26
An employee sends an email message to a fellow employee. The message is sent through the company's messaging server.
Which protocol is used to send the email message?
- A. IMAP
- B. POP3
- C. SNMP
- D. SMTP
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
SMTP (Simple Mail Transfer Protocol) is the protocol used to send email messages from a client to a mail server or between mail servers. It handles the transmission of outgoing mail. IMAP and POP3 are protocols used for retrieving email, not sending it. SNMP is used for network management.
* IMAP and POP3 are for receiving emails.
* SNMP is unrelated to email delivery.
This is documented in RFC 5321 and supported by all standard email system operations, including forensic analyses.
質問 # 27
A computer involved in a crime is infected with malware. The computer is on and connected to the company's network. The forensic investigator arrives at the scene.
Which action should be the investigator's first step?
- A. Turn off the computer
- B. Unplug the computer's Ethernet cable
- C. Copy files to external media
- D. Run malware removal tools
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Disconnecting the computer from the network by unplugging the Ethernet cable prevents further spread of malware and stops external communication that could lead to data exfiltration. This containment step is vital before further evidence collection.
* Maintaining system power preserves volatile memory.
* Network disconnection is recommended by incident response guidelines.
Reference:NIST SP 800-61 recommends isolating affected systems from networks early in incident response.
質問 # 28
On which file does the Windows operating system store hashed passwords?
- A. System
- B. NTUSER.dat
- C. Kerberos
- D. SAM
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Windows stores user account password hashes in theSecurity Account Manager (SAM)file, located inC:
\Windows\System32\config. This file contains encrypted NTLM password hashes that can be extracted with forensic tools for analysis.
* SAM is critical for authentication evidence.
* The file is locked when Windows is running and must be acquired via imaging or offline analysis.
* Kerberos is an authentication protocol, not a password storage file.
Reference:NIST Windows Forensic Analysis documentation identifies the SAM file as the location of hashed credentials.
質問 # 29
What are the three basic tasks that a systems forensic specialist must keep in mind when handling evidence during a cybercrime investigation?
- A. Preserve evidence, encrypt evidence, and delete evidence
- B. Find evidence, preserve evidence, and prepare evidence
- C. Analyze evidence, prepare evidence, and document evidence
- D. Find evidence, analyze evidence, and prosecute evidence
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The fundamental tasks for a forensic specialist are to locate potential digital evidence, ensure its preservation to prevent tampering or loss, and prepare the evidence for analysis or legal proceedings. Proper handling maintains the evidentiary value of digital artifacts.
* Preservation includes using write-blockers and documenting chain of custody.
* Preparation may involve imaging, cataloging, and validating evidence.
Reference:NIST SP 800-86 emphasizes these stages as critical components of forensic processes.
質問 # 30
Which Windows component is responsible for reading the boot.ini file and displaying the boot loader menu on Windows XP during the boot process?
- A. Winload.exe
- B. BOOTMGR
- C. BCD
- D. NTLDR
正解：D
解説：
Comprehensive and Detailed Explanation From Exact Extract:
NTLDR (NT Loader) is the boot loader for Windows NT-based systems including Windows XP. It reads the boot.ini configuration file and displays the boot menu, initiating the boot process.
* Later Windows versions (Vista and above) replaced NTLDR with BOOTMGR.
* Understanding boot components assists forensic investigators in boot process analysis.
Reference:Microsoft technical documentation and forensic training materials outline NTLDR's role in legacy Windows systems.
質問 # 31
A forensic investigator wants to collect evidence from a file created by a Macintosh computer running OS X
10.8.
Which file type can be created by this OS?
- A. MFS
- B. HFS+
- C. ReiserFS
- D. NTFS
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
Mac OS X 10.8 (Mountain Lion) uses the HFS+ (Hierarchical File System Plus) file system by default for its native storage volumes. HFS+ is Apple's proprietary file system introduced in the late 1990s, designed for macOS.
* ReiserFS is a Linux file system.
* MFS (Macintosh File System) is an outdated file system replaced by HFS.
* NTFS is a Windows file system.
This is well documented in Apple technical specifications and forensic analysis standards for macOS systems.
Reference:Digital forensics references including NIST guidelines and vendor documentation confirm HFS+ as the standard file system for Mac OS X versions prior to APFS adoption.
質問 # 32
Which law requires a search warrant or one of the recognized exceptions to search warrant requirements for searching email messages on a computer?
- A. The Fourth Amendment to the U.S. Constitution
- B. Stored Communications Act
- C. Communications Assistance to Law Enforcement Act (CALEA)
- D. Electronic Communications Privacy Act (ECPA)
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The Fourth Amendment protects against unreasonable searches and seizures, requiring law enforcement to obtain a search warrant based on probable cause before searching private emails on computers, except in certain recognized exceptions (such as consent or exigent circumstances).
* Protects privacy rights in digital communication.
* Failure to obtain proper legal authorization can invalidate evidence.
Reference:NIST guidelines and U.S. Supreme Court rulings affirm the Fourth Amendment's application to digital searches.
質問 # 33
The chief information security officer of a company believes that an attacker has infiltrated the company's network and is using steganography to communicate with external sources. A security team is investigating the incident. They are told to start by focusing on the core elements of steganography.
What are the core elements of steganography?
- A. File, metadata, header
- B. Payload, carrier, channel
- C. Encryption, decryption, key
- D. Hash, nonce, salt
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
The core elements of steganography include:
* Payload: the hidden data or message,
* Carrier: the medium (e.g., image, audio file) containing the payload,
* Channel: the method or path used to deliver the carrier with the payload embedded.
* Understanding these elements helps investigators detect and analyze steganographic content.
Reference:NIST SP 800-101 and steganography research identify these core components as fundamental to steganographic communication.
質問 # 34
Which United States law requires telecommunications equipment manufacturers to provide built-in surveillance capabilities for federal agencies?
- A. Communications Assistance to Law Enforcement Act (CALEA)
- B. The Privacy Protection Act (PPA)
- C. Health Insurance Portability and Accountability Act (HIPAA)
- D. Electronic Communications Privacy Act (ECPA)
正解：A
解説：
Comprehensive and Detailed Explanation From Exact Extract:
CALEA mandates that telecommunications equipment and service providers design systems capable of allowing federal law enforcement to conduct authorized electronic surveillance. This includes wiretapping and data interception capabilities.
* This law is essential for lawful monitoring in investigations.
* It affects hardware design and network infrastructure.
Reference:CALEA is consistently referenced in forensic standards concerning lawful interception requirements.
質問 # 35
Which operating system (OS) uses the NTFS (New Technology File System) file operating system?
- A. Mac OS X v10.5
- B. Windows 8
- C. Mac OS X v10.4
- D. Linux
正解：B
解説：
Comprehensive and Detailed Explanation From Exact Extract:
NTFS is the primary file system used by Microsoft Windows operating systems starting from Windows NT and continuing through modern versions including Windows 8. NTFS supports advanced features like file permissions, encryption, and journaling, which are critical for modern OS file management.
* Linux typically uses ext3, ext4, or other native file systems, not NTFS as a primary system.
* Mac OS X v10.4 and v10.5 use HFS+ as the native file system, not NTFS.
* Windows 8 uses NTFS as its default file system.
This is documented in official Microsoft and NIST digital forensics resources.
質問 # 36
......
Digital-Forensics-in-Cybersecurity試験問題は練習は2026年最新の82問題：https://www.jpntest.com/shiken/Digital-Forensics-in-Cybersecurity-mondaishu
Digital-Forensics-in-Cybersecurity試験問題集パスと最新テスト問題集：https://drive.google.com/open?id=1dr-81vaIe1vFRmsNvjNUA5t53Y9OXLcT