You are preparing to acquire a server that has been involved in a security incident. The server is running a proprietary application that may be affected by the acquisition. You have two imaging tools: one is well-tested but slow, and the other is fast but has not been validated for this type of server. What is the best approach?

Use the fast tool to minimize disruption to the application

Ask the application vendor for a recommended tool

Use the well-tested tool, even if it takes longer

Use both tools simultaneously to compare results

What is the primary purpose of a chain of custody form in digital forensics?

To document every person who handled the evidence and when

To record the hash values of the forensic image

To list the tools used during the acquisition

To provide a summary of the investigation findings

You are performing a memory acquisition on a critical server. Your primary tool fails, and your backup tool is not compatible with the server's operating system version. You have a third tool that is compatible but has not been tested in your lab. What is the best course of action?

Power off the server and perform a disk image instead

Document the failure and end the acquisition

Use the third tool after a quick validation on a similar test system

Reboot the server into a different operating system to use the backup tool

Why should forensic tools be validated before performing an acquisition?

To confirm they produce accurate and reliable results

To determine the license cost of the tool

To make the tool run faster on the target system

To ensure the tool is compatible with the suspect's operating system

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 9)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 41–45

41expert · hard
You are preparing to acquire a server that has been involved in a security incident. The server is running a proprietary application that may be affected by the acquisition. You have two imaging tools: one is well-tested but slow, and the other is fast but has not been validated for this type of server. What is the best approach?
Select an answer first
42foundation · easy
What is the primary purpose of a chain of custody form in digital forensics?
Select an answer first
43foundation · easy
According to the order of volatility, which of the following should be collected first?
Select an answer first
44expert · hard
You are performing a memory acquisition on a critical server. Your primary tool fails, and your backup tool is not compatible with the server's operating system version. You have a third tool that is compatible but has not been tested in your lab. What is the best course of action?
Select an answer first
45foundation · easy
Why should forensic tools be validated before performing an acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Acquisition Preparation GBFA Practice Questions (Page 9)

Questions 41–45

What is the primary purpose of a chain of custody form in digital forensics?

According to the order of volatility, which of the following should be collected first?

You are performing a memory acquisition on a critical server. Your primary tool fails, and your backup tool is not compatible with the server's operating system version. You have a third tool that is compatible but has not been tested in your lab. What is the best course of action?

Why should forensic tools be validated before performing an acquisition?

Keep studying — Foundations and Preparation