A responder needs to acquire RAM from a Windows system that has BitLocker enabled on the system drive. Which consideration is most important when choosing a memory acquisition method?

The memory image may contain the BitLocker decryption keys, so it must be protected as highly sensitive evidence.

The memory image will be encrypted and cannot be analyzed.

BitLocker prevents the use of software-based memory acquisition tools.

You must decrypt the system drive before acquiring memory.

What is a primary limitation of using the dd command to acquire RAM?

dd cannot write to external storage devices.

dd automatically hashes the output, slowing down acquisition.

dd does not handle memory fragmentation and may produce an incomplete image.

dd is only available on Windows systems.

A forensic examiner is preparing to acquire OS artifacts from a Windows 10 system. Which set of artifacts should be prioritized to capture user activity and system configuration?

Registry hives, Prefetch files, and Windows Event Logs

System Restore points and shadow copies

Browser cache, cookies, and history

NTFS $MFT, USN journal, and $LogFile

You are collecting OS artifacts from a Linux server. Which command sequence best preserves the integrity of the collected files?

Run 'sha256sum' on the original files, copy them with 'dd', then run 'sha256sum' on the copies and compare.

Run 'cp -a' to copy files to an evidence drive, then run 'sha256sum' on the copies.

Use 'tar' to archive the files and store the archive on the same filesystem.

Use 'scp' to transfer the files to a remote server without hashing.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 4

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 8)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 36–40

36application · medium
A responder needs to acquire RAM from a Windows system that has BitLocker enabled on the system drive. Which consideration is most important when choosing a memory acquisition method?
Select an answer first
37foundation · easy
What is a primary limitation of using the dd command to acquire RAM?
Select an answer first
38application · medium
A forensic examiner is preparing to acquire OS artifacts from a Windows 10 system. Which set of artifacts should be prioritized to capture user activity and system configuration?
Select an answer first
39application · medium
An examiner is categorizing OS artifacts for a Windows forensic acquisition. Which category includes the Windows Event Logs?
Select an answer first
40application · medium
You are collecting OS artifacts from a Linux server. Which command sequence best preserves the integrity of the collected files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.