An examiner is analyzing a raw disk image and needs to locate a specific string that appears in the file system metadata. The string is stored as a sequence of 16-bit Unicode characters. Which data representation concept is most relevant to interpreting the string correctly?

The IP address of the source machine

Endianness of the multi-byte character encoding

The file extension of the image file

The cluster size of the file system

How does a file system typically organize data on a storage device?

In a hierarchical structure of directories and files

In random order with no structure

In a flat list of all files without any folders

In a single large database table

A forensic team is investigating a network breach. They have a packet capture that shows communication between an internal host and an external server. The team needs to identify which application protocol was used, but the traffic is encrypted. Which approach is most effective?

Look for DNS queries to identify the protocol

Analyze the TCP/UDP port numbers to infer the application protocol

Use deep packet inspection to decrypt the traffic

Examine the IP addresses to determine the protocol

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 2

Computer Fundamentals GBFA Practice Questions (Page 1)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 1–5

1expert · medium
A forensic analyst is examining a file that contains a timestamp stored as a 32-bit integer representing seconds since January 1, 1970. The analyst needs to convert this to a human-readable date. Which data representation concept is most relevant?
Select an answer first
2application · medium
An examiner is analyzing a raw disk image and needs to locate a specific string that appears in the file system metadata. The string is stored as a sequence of 16-bit Unicode characters. Which data representation concept is most relevant to interpreting the string correctly?
Select an answer first
3application · easy
A network administrator is setting up a small forensic lab and needs to ensure that devices on the same local network can communicate using IP addresses. Which protocol is responsible for assigning IP addresses to devices automatically?
Select an answer first
4foundation · easy
How does a file system typically organize data on a storage device?
Select an answer first
5expert · hard
A forensic team is investigating a network breach. They have a packet capture that shows communication between an internal host and an external server. The team needs to identify which application protocol was used, but the traffic is encrypted. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Computer Fundamentals GBFA Practice Questions (Page 1)

Questions 1–5

A forensic analyst is examining a file that contains a timestamp stored as a 32-bit integer representing seconds since January 1, 1970. The analyst needs to convert this to a human-readable date. Which data representation concept is most relevant?

An examiner is analyzing a raw disk image and needs to locate a specific string that appears in the file system metadata. The string is stored as a sequence of 16-bit Unicode characters. Which data representation concept is most relevant to interpreting the string correctly?

A network administrator is setting up a small forensic lab and needs to ensure that devices on the same local network can communicate using IP addresses. Which protocol is responsible for assigning IP addresses to devices automatically?

How does a file system typically organize data on a storage device?

A forensic team is investigating a network breach. They have a packet capture that shows communication between an internal host and an external server. The team needs to identify which application protocol was used, but the traffic is encrypted. Which approach is most effective?

Keep studying — Foundations and Preparation