A forensic examiner is tasked with acquiring the contents of a server's RAM that is running a critical database. The server has 64 GB of RAM and is using a 1 TB NVMe SSD for storage. The examiner has a write-blocker and a USB 3.0 external drive. The acquisition must be completed as quickly as possible to minimize downtime. Which approach is most appropriate?

Copy the contents of the page file to the external drive.

Use the write-blocker to connect the NVMe SSD to the examiner's workstation and image it.

Use a memory acquisition tool to dump the RAM to the external USB drive.

Power down the server and remove the RAM modules for physical imaging.

During a network forensic investigation, an examiner captures packets and needs to identify which device on a local subnet sent a particular request. The examiner has the device's IP address but needs to find its physical address. Which protocol is used to resolve this?

HTTP (Hypertext Transfer Protocol)

DHCP (Dynamic Host Configuration Protocol)

ARP (Address Resolution Protocol)

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 2

Computer Fundamentals GBFA Practice Questions (Page 3)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 11–15

11application · easy
A forensic examiner is building a workstation to analyze large disk images. The examiner wants to maximize the speed of reading and writing image files. Which storage technology should the examiner choose for the working drive?
Select an answer first
12expert · medium
A network forensic investigator is analyzing a pcap file and sees a TCP handshake between two hosts. The investigator wants to determine the initial sequence number (ISN) of the connection. Which packet in the capture should be examined?
Select an answer first
13application · medium
A forensic analyst is working on a Linux system and needs to list all running processes to identify a suspicious process. Which operating system feature provides the interface to view and manage processes?
Select an answer first
14expert · hard
A forensic examiner is tasked with acquiring the contents of a server's RAM that is running a critical database. The server has 64 GB of RAM and is using a 1 TB NVMe SSD for storage. The examiner has a write-blocker and a USB 3.0 external drive. The acquisition must be completed as quickly as possible to minimize downtime. Which approach is most appropriate?
Select an answer first
15application · medium
During a network forensic investigation, an examiner captures packets and needs to identify which device on a local subnet sent a particular request. The examiner has the device's IP address but needs to find its physical address. Which protocol is used to resolve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Computer Fundamentals GBFA Practice Questions (Page 3)

Questions 11–15

A forensic examiner is building a workstation to analyze large disk images. The examiner wants to maximize the speed of reading and writing image files. Which storage technology should the examiner choose for the working drive?

A network forensic investigator is analyzing a pcap file and sees a TCP handshake between two hosts. The investigator wants to determine the initial sequence number (ISN) of the connection. Which packet in the capture should be examined?

A forensic analyst is working on a Linux system and needs to list all running processes to identify a suspicious process. Which operating system feature provides the interface to view and manage processes?

During a network forensic investigation, an examiner captures packets and needs to identify which device on a local subnet sent a particular request. The examiner has the device's IP address but needs to find its physical address. Which protocol is used to resolve this?

Keep studying — Foundations and Preparation