What is the purpose of testing a write-blocker before using it in an acquisition?

To make the forensic image smaller

To ensure it prevents any writes to the source drive

To increase the speed of the acquisition

To verify the source drive is not encrypted

You arrive at a scene where a server is still running, a network switch is powered on, and several external drives are connected. The incident involves suspected data exfiltration. Which of the following should be your highest priority during scene assessment?

Identify all potential sources of volatile and non-volatile evidence

Ask the system administrator to log in and check for active connections

Power off the server to prevent further data loss

Immediately disconnect the external drives

A junior examiner is about to acquire evidence from a USB drive found at a crime scene. The examiner is unsure whether the USB drive contains any relevant evidence. What is the PRIMARY purpose of acquisition preparation in this scenario?

To ensure that the acquisition is conducted in a forensically sound manner, preserving the integrity of the evidence.

To determine whether the USB drive contains any evidence before starting the acquisition.

To decide whether the USB drive is worth acquiring based on its storage capacity.

To obtain permission from the suspect before acquiring the USB drive.

You are preparing to image a RAID server at a client site. Your primary write blocker fails during the initial test. You have a second write blocker in your kit, but it is a different model that you have never used. What is the best course of action?

Proceed with the second write blocker because it is the only option

Image the server without a write blocker because RAID is read-only

Cancel the acquisition and return another day

Use the second write blocker after verifying it works on a test drive

A forensic examiner is asked to acquire evidence from a personal laptop belonging to an employee who is under investigation for policy violations. The employee is present and refuses to give consent. The company's legal counsel states that the laptop is company-owned and the employee signed a policy allowing inspection. What should the examiner do?

Proceed with the acquisition based on the company's ownership and the signed policy.

Ask the employee to sign a new consent form before proceeding.

Wait for the employee to give consent before proceeding.

Refuse to perform the acquisition without a court order.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 1)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 1–5

1foundation · easy
What is the purpose of testing a write-blocker before using it in an acquisition?
Select an answer first
2application · medium
You arrive at a scene where a server is still running, a network switch is powered on, and several external drives are connected. The incident involves suspected data exfiltration. Which of the following should be your highest priority during scene assessment?
Select an answer first
3application · medium
A junior examiner is about to acquire evidence from a USB drive found at a crime scene. The examiner is unsure whether the USB drive contains any relevant evidence. What is the PRIMARY purpose of acquisition preparation in this scenario?
Select an answer first
4application · medium
You are preparing to image a RAID server at a client site. Your primary write blocker fails during the initial test. You have a second write blocker in your kit, but it is a different model that you have never used. What is the best course of action?
Select an answer first
5application · medium
A forensic examiner is asked to acquire evidence from a personal laptop belonging to an employee who is under investigation for policy violations. The employee is present and refuses to give consent. The company's legal counsel states that the laptop is company-owned and the employee signed a policy allowing inspection. What should the examiner do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.