Which of the following is an example of a contingency plan during acquisition?

Documenting the acquisition steps in a notebook

Selecting the fastest acquisition method

Having a spare write-blocker available in case the primary one fails

Using the same tool for all acquisitions

You are about to leave for a remote acquisition site. Your forensic laptop has the imaging software installed, but you have not tested it since the last update. You also notice the write blocker's firmware is outdated. What is the most appropriate action before departing?

Test the imaging software and write blocker on a non-evidential drive

Update the write blocker firmware at the site

Proceed because the tools worked last month

Bring a second write blocker but do not test it

A forensic examiner is preparing to acquire evidence from a RAID server. The examiner has a write blocker, a forensic imaging tool, and a spare RAID controller. During the acquisition, the RAID controller fails. What is the MOST appropriate contingency action?

Abort the acquisition and document the failure.

Power off the server and restart the acquisition from the beginning.

Continue the acquisition without the RAID controller, hoping the server will function.

Replace the RAID controller with the spare and continue the acquisition.

You are about to perform a forensic acquisition of a laptop. You have verified that your write blocker works, but you realize you forgot to bring the external hard drive you planned to use for the image. You have a USB flash drive with enough capacity. What should you do?

Use the USB flash drive after verifying it is forensically clean

Image the laptop to the internal drive of your forensic workstation

Proceed with the USB flash drive without checking it

Cancel the acquisition until you have the proper external drive

Why is the order of volatility important in forensic acquisition?

It helps select the appropriate acquisition tool

It reduces the total time needed for the acquisition

It determines the legal authority needed for the acquisition

It ensures that the most fragile evidence is preserved before it is lost

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 3)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 11–15

11foundation · easy
Which of the following is an example of a contingency plan during acquisition?
Select an answer first
12application · medium
You are about to leave for a remote acquisition site. Your forensic laptop has the imaging software installed, but you have not tested it since the last update. You also notice the write blocker's firmware is outdated. What is the most appropriate action before departing?
Select an answer first
13application · medium
A forensic examiner is preparing to acquire evidence from a RAID server. The examiner has a write blocker, a forensic imaging tool, and a spare RAID controller. During the acquisition, the RAID controller fails. What is the MOST appropriate contingency action?
Select an answer first
14application · medium
You are about to perform a forensic acquisition of a laptop. You have verified that your write blocker works, but you realize you forgot to bring the external hard drive you planned to use for the image. You have a USB flash drive with enough capacity. What should you do?
Select an answer first
15foundation · easy
Why is the order of volatility important in forensic acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.