Acquisition Preparation GBFA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An examiner arrives at a scene where a computer is running, a smartphone is on the desk, and a network-attached storage (NAS) device is connected to the network. The examiner must prioritize the acquisition of evidence. Which of the following is the MOST appropriate order of acquisition?

   • ANAS, smartphone, network connections, RAM.
   • BRAM, network connections, smartphone, NAS.
   • CSmartphone, RAM, network connections, NAS.
   • DNetwork connections, RAM, smartphone, NAS.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   You are planning the acquisition of a corporate server that is part of a critical production environment. The server contains a database with customer data. The legal team has authorized the acquisition, but the business requires minimal downtime. The server is running and has an encrypted volume. What is the most appropriate acquisition strategy?

   • AImmediately power off the server and perform a full disk image
   • BCopy the encrypted volume without the encryption key
   • CPerform a live acquisition of memory and logical files, then coordinate a scheduled downtime for a full disk image
   • DPerform only a logical acquisition of the database files
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A forensic examiner is acquiring evidence from a company's file server as part of a criminal investigation. The examiner has completed the acquisition and is preparing to transport the evidence to the lab. The examiner must ensure the chain of custody is maintained. Which of the following actions is MOST critical?

   • AEmail the evidence to the lab to avoid physical transport.
   • BSeal the evidence container with a tamper-evident seal and document the seal number.
   • CPlace the evidence in a secure locker at the lab and document who has access.
   • DMake a backup copy of the evidence and keep it in a separate location.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic examiner is called to acquire data from a company-owned laptop used by a recently terminated employee. The employee's manager provides verbal approval for the acquisition and hands over the laptop. The company's legal counsel confirms that the employee signed an acceptable-use policy stating that company devices may be searched upon termination. What is the most appropriate next step before beginning the acquisition?

   • AAsk the terminated employee for consent to search the laptop before proceeding.
   • BBegin the acquisition immediately since the acceptable-use policy provides blanket authorization.
   • CProceed with the acquisition but only after taking a photograph of the manager's verbal approval in the presence of a witness.
   • DObtain written authorization from the appropriate company authority, such as legal counsel or a designated executive, and document it in the case file.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A law enforcement officer asks you to acquire data from a smartphone found at a crime scene. The phone is locked, and the officer wants you to bypass the lock to extract data. What should you do first?

   • AAttempt to bypass the lock using available tools
   • BPlace the phone in a Faraday bag and wait for instructions
   • CAsk the officer to unlock the phone with the suspect's fingerprint
   • DConfirm that you have legal authority to bypass the lock and extract data
   Reveal Solution Discussion Select an answer first