A forensic examiner is analyzing a USB drive that was used to transfer files between a Windows machine and a Linux machine. The drive is formatted with FAT32. Which characteristic of FAT32 is most relevant to the examiner's analysis?

It uses a journal to protect against data corruption.

It stores file metadata in a centralized database called the MFT.

It has a maximum file size limit of 4 GB.

It supports file permissions and encryption at the file level.

A forensic examiner is preparing to image a computer that has 16 GB of RAM and a 1 TB hard drive. The examiner wants to capture the contents of RAM before shutting down the system. Which tool or method is most appropriate?

Booting from a forensic live CD and using a disk imaging tool

Removing the RAM and reading it with a hardware programmer

A memory acquisition tool that runs on the live system

Copying the page file to an external drive

Which of the following is a key function of an operating system?

Providing electrical power to the motherboard

Compiling source code into machine code

Managing memory and process scheduling

An examiner is comparing two forensic images: one from a system using NTFS and another from a system using ext4. The examiner needs to identify which file system is more likely to store file permissions and ownership metadata in a way that is native to the file system. Which statement is accurate?

Both NTFS and ext4 support file permissions and ownership natively.

Neither file system stores permissions; they are stored in the OS registry.

Only NTFS supports file permissions; ext4 does not.

Only ext4 supports file permissions; NTFS does not.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 2

Computer Fundamentals GBFA Practice Questions (Page 6)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 26–30

26application · medium
A forensic examiner is analyzing a USB drive that was used to transfer files between a Windows machine and a Linux machine. The drive is formatted with FAT32. Which characteristic of FAT32 is most relevant to the examiner's analysis?
Select an answer first
27application · medium
A forensic examiner is preparing to acquire data from a computer that has 16 GB of RAM and a 1 TB hard drive. The examiner wants to capture the contents of RAM for analysis. Which hardware component is the primary source of the data being acquired?
Select an answer first
28application · medium
A forensic examiner is preparing to image a computer that has 16 GB of RAM and a 1 TB hard drive. The examiner wants to capture the contents of RAM before shutting down the system. Which tool or method is most appropriate?
Select an answer first
29foundation · easy
Which of the following is a key function of an operating system?
Select an answer first
30application · medium
An examiner is comparing two forensic images: one from a system using NTFS and another from a system using ext4. The examiner needs to identify which file system is more likely to store file permissions and ownership metadata in a way that is native to the file system. Which statement is accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.