A forensic examiner is analyzing a Linux system that has multiple mounted filesystems. The examiner needs to identify which directory is a separate mount point versus a regular directory. Which command or file would provide this information?

Run `cat /etc/fstab` to see which directories are mount points.

Run `mount` without arguments to list all mounted filesystems and their mount points.

Run `df -h` to see disk usage, which lists all directories.

Run `ls -l /` to see which directories have a 'd' in the permissions.

A forensic examiner is analyzing a Linux system that has a separate `/boot` partition. The examiner needs to understand why `/boot` is often a separate partition. Which reason is most accurate?

To increase the speed of booting by placing `/boot` on a faster disk.

To allow the root filesystem to be resized without affecting the boot files.

To prevent users from accessing the kernel files.

To allow the boot loader to access the kernel and initrd even if the root filesystem is encrypted or uses a filesystem the boot loader cannot read.

A forensic examiner is comparing FAT32 and NTFS for a case involving a USB drive. The examiner needs to explain a key difference in how each filesystem handles file metadata. Which statement is correct?

FAT32 and NTFS both use the same metadata structures.

FAT32 stores file metadata in a directory entry, while NTFS stores metadata in the MFT.

FAT32 uses inodes, while NTFS uses a Master File Table.

FAT32 stores metadata in a journal, while NTFS does not.

A forensic examiner is comparing NTFS and ext4 for a case involving a Windows system. The examiner needs to explain a key difference in how each filesystem stores metadata. Which statement is correct?

NTFS uses inodes, while ext4 uses a Master File Table.

NTFS uses a Master File Table (MFT) that stores file metadata and data in attributes, while ext4 uses inodes that point to data blocks.

NTFS stores all file data in the MFT, while ext4 stores all data in inodes.

Both NTFS and ext4 use a single central table for all file metadata.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 1

Filesystem Fundamentals GBFA Practice Questions (Page 2)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 6–10

6application · easy
A forensic examiner is analyzing a Linux system that has multiple mounted filesystems. The examiner needs to identify which directory is a separate mount point versus a regular directory. Which command or file would provide this information?
Select an answer first
7foundation · easy
What is the smallest unit of data storage in a computer, representing a binary value of 0 or 1?
Select an answer first
8application · medium
A forensic examiner is analyzing a Linux system that has a separate `/boot` partition. The examiner needs to understand why `/boot` is often a separate partition. Which reason is most accurate?
Select an answer first
9application · easy
A forensic examiner is comparing FAT32 and NTFS for a case involving a USB drive. The examiner needs to explain a key difference in how each filesystem handles file metadata. Which statement is correct?
Select an answer first
10application · easy
A forensic examiner is comparing NTFS and ext4 for a case involving a Windows system. The examiner needs to explain a key difference in how each filesystem stores metadata. Which statement is correct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.