An employee sends an email message to a fellow employee. The message is sent through the company's messaging server.Which protocol is used to send the email message?
Answer(s): D
Comprehensive and Detailed Explanation From Exact Extract:SMTP (Simple Mail Transfer Protocol) is the protocol used to send email messages from a client to a mail server or between mail servers. It handles the transmission of outgoing mail. IMAP and POP3 are protocols used for retrieving email, not sending it. SNMP is used for network management.IMAP and POP3 are for receiving emails.SNMP is unrelated to email delivery.This is documented in RFC 5321 and supported by all standard email system operations, including forensic analyses.
A forensic examiner is reviewing a laptop running OS X which has been compromised. The examiner wants to know if any shell commands were executed by any of the accounts.Which log file or folder should be reviewed?
Answer(s): B
Comprehensive and Detailed Explanation From Exact Extract:The .bash_history file located in each user's home directory (e.g., /Users/<user>/.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user./var/vm contains virtual memory swap files, not command history./var/log contains system logs but not individual user shell command history./Users/<user>/Library/Preferences stores application preferences.NIST guidelines and macOS forensics literature confirm .bash_history as the standard location for shell command histories on OS X systems.
Which directory contains the system's configuration files on a computer running Mac OS X?
Answer(s): C
Comprehensive and Detailed Explanation From Exact Extract:The /etc directory on Unix-based systems, including macOS, contains important system configuration files and scripts. It is the standard location for system-wide configuration data./var contains variable data like logs and spool files./bin contains essential binary executables./cfg is not a standard directory in macOS.This is standard Unix/Linux directory structure knowledge and is reflected in NIST and forensic references for macOS.
Which Windows 7 operating system log stores events collected from remote computers?
Comprehensive and Detailed Explanation From Exact Extract:The ForwardedEvents log in Windows 7 is specifically designed to store events collected from remote computers via event forwarding. This log is part of the Windows Event Forwarding feature used in enterprise environments to centralize event monitoring.The System and Application logs store local system and application events.The Security log stores local security-related events.ForwardedEvents collects and stores events forwarded from other machines.Microsoft documentation and NIST SP 800-86 mention the use of ForwardedEvents for centralized event log collection in investigations.
A forensic investigator suspects that spyware has been installed to a Mac OS X computer by way of an update.Which Mac OS X log or folder stores information about system and software updates?
Comprehensive and Detailed Explanation From Exact Extract:The /Library/Receipts folder on Mac OS X contains receipts that track software installation and updates, including system and application updates. This folder helps forensic investigators determine which updates were installed and when, useful for detecting suspicious or unauthorized software installations like spyware./var/spool/cups is related to printer spooling./var/log/daily.out contains daily system log summaries but not detailed update records./var/vm contains virtual memory files.NIST and Apple forensics documentation indicate that /Library/Receipts is a key location for examining software installation history.
Post your Comments and Discuss WGU Digital-Forensics-in-Cybersecurity exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Digital-Forensics-in-Cybersecurity content, but please register or login to continue.