GIAC (SANS)

GIAC Battlefield Forensics and Acquisition

GBFA

The GIAC Battlefield Forensics and Acquisition (GBFA) certification validates a practitioner's readiness to handle every facet of the data collection and rapid triage process. It proves you can properly collect, acquire, and conduct rapid triage analysis across a wide range of data storage—from portable devices and servers to IoT and cloud. For federal agents, incident responders, and forensic analysts, GBFA demonstrates you can deliver indispensable data acquisition and analysis when it matters most, on the technical battlefield.

Practice Free Questions

6Domains

19Objectives

164Practice pages

786Free questions

GBFA free practice questions

Choose any objective and open any question page — no sign-in required.

Acquisition Preparation

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

Computer Fundamentals

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

Physical Storage Devices

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

Storage Technologies

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Filesystem Fundamentals

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

Windows Filesystems

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

Data on Drives

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Dead Box Acquisition

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Host Based Live Acquisition

52 questions · 11 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–52

Remote Acquisition

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Acquiring RAM and OS Artifacts

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

Mobile Device Acquisition

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Mobile Device Triage

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Specialty Device Fundamentals

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Data on the Network

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Working With Evidence Files

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Manual Triage

51 questions · 11 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–51

Manually Finding Data

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Using Forensic Tools for Triage

45 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (19 objectives · 164 pages).

GIAC Battlefield Forensics and Acquisition

GBFA free practice questions

Domain 1 · Foundations and Preparation21% of practice bank · 4 objectives · 163 questions21%

Domain 2 · Filesystems and Data Storage13% of practice bank · 3 objectives · 106 questions13%

Domain 3 · Acquisition Techniques23% of practice bank · 4 objectives · 184 questions23%

Domain 4 · Mobile and Specialty Devices13% of practice bank · 3 objectives · 106 questions13%

Domain 5 · Network and Evidence Handling11% of practice bank · 2 objectives · 87 questions11%

Domain 6 · Triage and Manual Analysis18% of practice bank · 3 objectives · 140 questions18%