You have completed a forensic acquisition of a laptop. You are preparing to transport the laptop and the image to your lab. The case involves sensitive personal data. What is the most important consideration for maintaining the chain of custody and protecting the data?

Seal the laptop and image in tamper-evident bags and document the transfer

Mail the laptop and image to the lab without tracking

Keep the laptop and image in your personal vehicle overnight

Encrypt the image and store it in the cloud for backup

You are responding to a live incident where a suspect is actively deleting files on a workstation. The system has an encrypted hard drive, and the encryption key is currently in memory. What should you prioritize?

Power off the system immediately to stop file deletion

Image the hard drive first because it contains the deleted files

Disconnect the network cable to prevent remote access

Capture the memory to obtain the encryption key

In the context of digital forensics, what is the primary purpose of acquisition preparation?

To document the final forensic report for the court

To ensure that all potential evidence is collected in a forensically sound manner

To obtain legal authorization to seize the suspect's computer

To analyze the acquired data for indicators of compromise

What is the first step in pre-acquisition planning for a digital forensic acquisition?

Define the objectives and scope of the acquisition

Power off the suspect's computer

Select the forensic tool to be used

Create a forensic image of the hard drive

You are planning the acquisition of a server that is part of a legal investigation. The server is located in a data center that is in another state. The legal team has obtained a warrant for the server, but the data center's terms of service require you to notify them before any forensic activity. What is the best approach?

Proceed immediately because the warrant overrides the terms of service

Cancel the acquisition and request the data be produced through legal discovery

Ask the data center to perform the acquisition on your behalf

Coordinate with the data center and legal team to schedule the acquisition in compliance with the warrant and terms of service

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 7)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 31–35

31expert · hard
You have completed a forensic acquisition of a laptop. You are preparing to transport the laptop and the image to your lab. The case involves sensitive personal data. What is the most important consideration for maintaining the chain of custody and protecting the data?
Select an answer first
32application · medium
You are responding to a live incident where a suspect is actively deleting files on a workstation. The system has an encrypted hard drive, and the encryption key is currently in memory. What should you prioritize?
Select an answer first
33foundation · easy
In the context of digital forensics, what is the primary purpose of acquisition preparation?
Select an answer first
34foundation · easy
What is the first step in pre-acquisition planning for a digital forensic acquisition?
Select an answer first
35expert · hard
You are planning the acquisition of a server that is part of a legal investigation. The server is located in a data center that is in another state. The legal team has obtained a warrant for the server, but the data center's terms of service require you to notify them before any forensic activity. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.