A forensic team has captured network traffic from a compromised server using a portable capture device. The capture is stored on a USB drive. The team must ensure the evidence is admissible in court. Which action is most critical to maintain the chain of custody?

Copy the capture file to a network share to ensure multiple copies exist.

Create a SHA-256 hash of the capture file immediately after acquisition and document the hash in the evidence log.

Label the USB drive with the case number and store it in a locked drawer.

Encrypt the USB drive with a password known only to the lead examiner.

A system administrator wants to monitor network traffic for a security investigation but is concerned about privacy regulations. The company is located in a jurisdiction that requires consent for monitoring employee communications. Which action is most appropriate before starting the capture?

Obtain written consent from all employees or ensure the monitoring is authorized by a legitimate business purpose and disclosed in the company policy.

Only capture traffic to and from the suspected employee's workstation.

Capture all traffic without informing employees to avoid alerting the suspected employee.

Ask the legal department for a verbal approval without documentation.

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 1

Data on the Network GBFA Practice Questions (Page 9)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 41–43

41application · medium
A forensic team has captured network traffic from a compromised server using a portable capture device. The capture is stored on a USB drive. The team must ensure the evidence is admissible in court. Which action is most critical to maintain the chain of custody?
Select an answer first
42foundation · easy
A forensic analyst observes a large number of TCP SYN packets sent to a single host from many different source IP addresses, but no SYN-ACK responses are seen. This pattern is most characteristic of which type of activity?
Select an answer first
43application · medium
A system administrator wants to monitor network traffic for a security investigation but is concerned about privacy regulations. The company is located in a jurisdiction that requires consent for monitoring employee communications. Which action is most appropriate before starting the capture?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Data on the Network GBFA Practice Questions (Page 9)

Questions 41–43

A forensic team has captured network traffic from a compromised server using a portable capture device. The capture is stored on a USB drive. The team must ensure the evidence is admissible in court. Which action is most critical to maintain the chain of custody?

A forensic analyst observes a large number of TCP SYN packets sent to a single host from many different source IP addresses, but no SYN-ACK responses are seen. This pattern is most characteristic of which type of activity?

A system administrator wants to monitor network traffic for a security investigation but is concerned about privacy regulations. The company is located in a jurisdiction that requires consent for monitoring employee communications. Which action is most appropriate before starting the capture?

Keep studying — Network and Evidence Handling