WGU (D431/C840) Digital Forensics in Cybersecurity Course Exam - Topic 5 Question 4 Discussion

Actual exam question for WGU's WGU (D431/C840) Digital Forensics in Cybersecurity Course exam

Question #: 4
Topic #: 5

[All WGU (D431/C840) Digital Forensics in Cybersecurity Course Questions]

A forensic scientist arrives at a crime scene to begin collecting evidence.

What is the first thing the forensic scientist should do?

ASeize the computer immediately

BPhotograph all evidence in its original place

CDocument user passwords

DRun antivirus scans

Show Suggested Answer

Suggested Answer: B

Comprehensive and Detailed Explanation From Exact Extract:

Documenting the scene through photographs preserves the original state of evidence before it is moved or altered. This supports chain of custody and evidence integrity, providing context during analysis and court proceedings.

Photographic documentation is a standard step in forensic protocols.

It ensures the scene is accurately recorded.

According to forensic investigation standards (NIST SP 800-86), photographing the scene is the initial action upon arrival.

by Eliz at Nov 23, 2025, 05:30 PM

Limited Time Offer

25%

Off

Get Premium WGU (D431/C840) Digital Forensics in Cybersecurity Course Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Yolande

1 month ago

Running scans later is fine, but not before documenting!

upvoted 0 times

...

Nickolas

1 month ago

User passwords can wait; the scene is priority.

upvoted 0 times

...

Quentin

2 months ago

Yeah, you need to document everything before touching anything.

upvoted 0 times

...

Basilia

2 months ago

Seizing the computer right away could mess things up.

upvoted 0 times

...

Yolande

2 months ago

C sounds interesting, but is it really the first thing to do?

upvoted 0 times

...

Kara

2 months ago

Totally agree with B! Can't mess with the scene before capturing it.

upvoted 0 times

...

Earleen

2 months ago

Wait, why would you run antivirus scans right away? Seems off.

upvoted 0 times

...

Leanna

2 months ago

I think A is more important! You need the computer first!

upvoted 0 times

...

Iesha

3 months ago

B is definitely the first step! Gotta document everything.

upvoted 0 times

...

Reita

3 months ago

B, for "Bingo, you got it!" Photographing the scene is the way to go. Unless you want to be the next suspect, that is.

upvoted 0 times

...

Sarah

3 months ago

B is the correct answer. Preserving the evidence is key. Who cares about passwords or running scans at this stage? Amateurs.

upvoted 0 times

...

Justa

4 months ago

I'd go with B. Capturing the scene as it is should be the top priority. Passwords and antivirus can wait until later.

upvoted 0 times

...

Derick

4 months ago

Definitely B. Documenting the scene is crucial before touching anything. Seizing the computer first? What is this, amateur hour?

upvoted 0 times

...

Elmer

4 months ago

I’m leaning towards option B as well, but I wonder if there are situations where running antivirus scans might be prioritized instead.

upvoted 0 times

...

Loreta

4 months ago

I feel like seizing the computer immediately could be a good idea, but I also recall something about preserving the scene first.

upvoted 0 times

...

Sherell

4 months ago

I remember a practice question where we discussed the importance of documenting the scene before touching anything. So, B seems right to me.

upvoted 0 times

...

Chauncey

4 months ago

I think the first step should be to photograph all evidence in its original place, but I'm not entirely sure if that's always the case.

upvoted 0 times

...

Rodney

5 months ago

I feel pretty confident on this one. The first priority is to capture the scene as it was found, so B is the correct answer. Seizing devices or checking passwords can come later once the initial documentation is done.

upvoted 0 times

...

Sheron

5 months ago

Whoa, I didn't even consider passwords or antivirus scans. This is more complex than I thought. I'm going to have to review my notes on proper forensic procedures before answering this.

upvoted 0 times

...

Frankie

5 months ago

Okay, I've got this. The key is to document and preserve the crime scene first before collecting any specific evidence. So B, photographing the evidence, is definitely the right first step.

upvoted 0 times

...

Leota

5 months ago

Definitely! It preserves the scene.

upvoted 0 times

...

Jonelle

5 months ago

I think photographing all evidence first is crucial.

upvoted 0 times

...

Ruthann

5 months ago

B) Photograph all evidence in its original place is the way to go. Gotta preserve that crime scene, yo!

upvoted 0 times

...

Peter

6 months ago

I'm a bit confused on this one. Should they seize the computer immediately to preserve digital evidence? Or is photographing the scene more important first? I'm not sure, I'll have to think this through.

upvoted 0 times

...

Leontine

6 months ago

Hmm, this seems straightforward. I think the first thing the forensic scientist should do is photograph all the evidence in its original place, so B is the right answer.

upvoted 0 times