WGU Updated Digital-Forensics-in-Cybersecurity Exam Questions and Answers by natalie

Comprehensive and Detailed Explanation From Exact Extract:

The.bash_historyfile located in each user’s home directory (e.g.,/Users//.bash_history) records the history of shell commands entered by the user in bash shell sessions. Reviewing this file allows investigators to see the commands executed by a specific user.

/var/vmcontains virtual memory swap files, not command history.

/var/logcontains system logs but not individual user shell command history.

/Users//Library/Preferencesstores application preferences.

NIST guidelines and macOS forensics literature confirm.bash_historyas the standard location for shell command histories on OS X systems.

Comprehensive and Detailed Explanation From Exact Extract:

A bit-level (bitstream) copy creates an exact sector-by-sector duplicate of the original media, capturing all files, deleted data, and slack space. This method is essential to preserve the entirety of digital evidence without modification.

Bit-level imaging maintains forensic soundness.

It allows investigators to perform analysis without altering original data.

Comprehensive and Detailed Explanation From Exact Extract:

SMTP (Simple Mail Transfer Protocol) is the protocol used to send email messages from a client to a mail server or between mail servers. It handles the transmission of outgoing mail. IMAP and POP3 are protocols used for retrieving email, not sending it. SNMP is used for network management.

IMAP and POP3 are for receiving emails.

SNMP is unrelated to email delivery.

This is documented in RFC 5321 and supported by all standard email system operations, including forensic analyses.

Comprehensive and Detailed Explanation From Exact Extract:

Identity theft occurs when an attacker unlawfully obtains and uses another person's personal information to open accounts, access credit, or commit fraud. The opening of credit cards without the victim's consent is a classic example.

SQL injection is a web application attack method that does not directly relate to this case.

Cyberstalking involves harassment via digital means and is unrelated.

Malware is malicious software and may be used to facilitate identity theft but is not the crime itself.