A forensic examiner is about to acquire evidence from a company server as part of an internal investigation. The examiner has received written authorization from the company's legal department. Which of the following actions is MOST important to establish a proper chain of custody?

Label the evidence container with the case number and the examiner's name.

Make a backup copy of the evidence and keep it at the examiner's home for safekeeping.

Store the evidence in a secure locker that only the examiner has access to.

Document every person who handles the evidence, along with the date, time, and purpose of each transfer.

What is the purpose of a contingency plan in forensic acquisition?

To determine the order of volatility

To prepare for unexpected events that could compromise the acquisition

To ensure the acquisition tool is the latest version

To document the chain of custody

A forensic examiner is preparing to acquire evidence from a server that is part of a critical infrastructure environment. The server cannot be taken offline, and the acquisition must be performed live. The examiner has a forensic imaging tool that has been tested on a similar server, but the tool has not been updated in six months. What is the MOST appropriate course of action?

Update the tool to the latest version before the acquisition, even if it means delaying the acquisition.

Use the tested tool as-is, but document the tool's version and configuration in the case file.

Take the server offline to perform a traditional acquisition, despite the critical infrastructure requirement.

Use a different, untested tool that is known to be compatible with the server.

During a live incident response, an examiner must acquire evidence from a compromised server. The server is running, and the incident response team needs to preserve as much volatile data as possible. Which of the following actions should the examiner perform FIRST?

Capture the contents of RAM using a memory acquisition tool.

Record the current network connections and open ports.

Take photographs of the server's physical state and connections.

Copy the hard drive using a write blocker and forensic imaging tool.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 10)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 46–49

46application · medium
A forensic examiner is about to acquire evidence from a company server as part of an internal investigation. The examiner has received written authorization from the company's legal department. Which of the following actions is MOST important to establish a proper chain of custody?
Select an answer first
47foundation · easy
What is the purpose of a contingency plan in forensic acquisition?
Select an answer first
48expert · hard
A forensic examiner is preparing to acquire evidence from a server that is part of a critical infrastructure environment. The server cannot be taken offline, and the acquisition must be performed live. The examiner has a forensic imaging tool that has been tested on a similar server, but the tool has not been updated in six months. What is the MOST appropriate course of action?
Select an answer first
49application · medium
During a live incident response, an examiner must acquire evidence from a compromised server. The server is running, and the incident response team needs to preserve as much volatile data as possible. Which of the following actions should the examiner perform FIRST?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Acquisition Preparation GBFA Practice Questions (Page 10)

Questions 46–49

A forensic examiner is about to acquire evidence from a company server as part of an internal investigation. The examiner has received written authorization from the company's legal department. Which of the following actions is MOST important to establish a proper chain of custody?

What is the purpose of a contingency plan in forensic acquisition?

During a live incident response, an examiner must acquire evidence from a compromised server. The server is running, and the incident response team needs to preserve as much volatile data as possible. Which of the following actions should the examiner perform FIRST?

Keep studying — Foundations and Preparation