Which of the following is an example of analyzing application data to reconstruct user activity?

Checking the app's update history to see when it was last updated.

Reviewing a social media app's cached images to identify photos the user viewed.

Listing the app's required hardware features.

Examining the app's permissions to see if it can access the camera.

What is the purpose of hashing application data during a forensic examination?

To encrypt the data for secure transmission.

To verify the integrity of the data by detecting any changes.

To index the data for faster searching.

To compress the data for easier storage.

You are investigating a case involving a suspect's location history. You have extracted data from a fitness tracking app that shows GPS coordinates and timestamps. You also have call detail records (CDRs) from the suspect's mobile carrier. How can you best use this data to strengthen your case?

Present the fitness app data and CDRs as separate exhibits without correlating them, to avoid potential inconsistencies.

Use the CDR data to override the fitness app data, as carrier records are more reliable.

Correlate the fitness app's GPS coordinates with the CDR cell tower locations at the same timestamps to verify the suspect's presence at key locations.

Use only the fitness app data, as it is more precise than the CDR data, and ignore the CDRs.

What is the primary goal of correlating application data with other evidence sources?

To build a comprehensive timeline of user activity.

To increase the storage capacity of the device.

To encrypt the evidence for secure storage.

To remove irrelevant data from the investigation.

GIAC Advanced Smartphone Forensics

Domain 3Objective 1

Mobile Device Application Analysis GASF Practice Questions (Page 2)

Part of the Mobile Device Application Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 6–10 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

10concepts

Questions 6–10

6foundation · easy
On an Android device, which directory is the default sandboxed storage location for an application's private data?
Select an answer first
7foundation · easy
Which of the following is an example of analyzing application data to reconstruct user activity?
Select an answer first
8foundation · easy
What is the purpose of hashing application data during a forensic examination?
Select an answer first
9application · medium
You are investigating a case involving a suspect's location history. You have extracted data from a fitness tracking app that shows GPS coordinates and timestamps. You also have call detail records (CDRs) from the suspect's mobile carrier. How can you best use this data to strengthen your case?
Select an answer first
10foundation · easy
What is the primary goal of correlating application data with other evidence sources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.