Acquisition Preparation GBFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is preparing to acquire evidence from a laptop that is suspected to contain malware. The examiner has a write blocker, a forensic imaging tool, and a spare battery. During the acquisition, the laptop's battery dies, and the examiner needs to continue. What is the MOST appropriate contingency action?

   • APower off the laptop and restart the acquisition from the beginning.
   • BConnect the laptop to a power outlet and continue the acquisition.
   • CAbort the acquisition and document the failure.
   • DReplace the battery with the spare and continue the acquisition.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it necessary to verify the legal authority before starting an acquisition?

   • ATo determine the order of volatility for the evidence
   • BTo select the appropriate acquisition tool
   • CTo ensure the evidence will be admissible in court
   • DTo estimate the time required for the acquisition
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   You are responding to a ransomware incident on a Windows server. The server is still running, and you suspect the ransomware is actively encrypting files. You need to preserve evidence, but you also want to stop the encryption. What is the best strategy?

   • APower off the server immediately to stop the encryption
   • BDisconnect the network cable first, then image the disk
   • CCapture memory first, then isolate the server from the network, and then image the disk
   • DRun an anti-ransomware tool to stop the encryption
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What information should be recorded in the acquisition documentation?

   • AThe date, time, and location of the acquisition
   • BThe suspect's social media passwords
   • CThe investigator's personal notes about the case
   • DThe weather conditions at the scene
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A forensic examiner is called to acquire evidence from a company's mail server as part of an internal fraud investigation. The legal team has provided a court order that specifies a date range for emails to be collected. The server is running, and the examiner has a forensic imaging tool and a write blocker. The examiner must balance the need to preserve volatile data with the legal scope. What is the MOST appropriate course of action?

   • AAsk the legal team to expand the court order to include the entire server.
   • BCapture the server's RAM first, then acquire the specific email files within the court-ordered date range.
   • CSkip RAM capture and focus only on the email files within the date range.
   • DAcquire the entire server's hard drive first, then extract the emails within the date range.
   Reveal Solution Discussion Select an answer first