A forensic examiner is performing a live acquisition on a compromised server. The examiner uses a trusted tool on a USB drive and records the time and date of each command. Which additional action is most important for maintaining chain of custody?

Document the hash values of all acquired data and record who handled the evidence.

Disconnect the server from the network before starting.

Take a photograph of the screen after each command.

Ensure the USB drive is write-protected.

A forensic examiner is called to a site where a server is suspected of being compromised. The server is running and the examiner wants to preserve evidence. Which statement BEST describes the purpose of host-based live acquisition?

To capture volatile data from a running system that would be lost if the system were powered off.

To determine the operating system version and installed software.

To install forensic tools on the suspect system for later analysis.

To create a bit-for-bit copy of the hard drive without turning off the system.

A forensic responder is called to a Windows server that is suspected of being compromised by a rootkit. The responder has a trusted USB toolkit but is concerned that the rootkit may be hiding processes and network connections. The responder must decide whether to trust the live system's API or use lower-level methods. Which approach is most defensible?

Run a full antivirus scan on the live system.

Rely on the built-in task manager to list processes.

Use a memory acquisition tool to capture RAM and perform offline analysis to identify hidden processes.

Use netstat to list network connections and trust the output.

A responder is collecting evidence from a live system that is suspected of being used for child exploitation. The responder has a warrant and must collect evidence that will hold up in court. The system is running Windows 10 and the user is actively using it. Which action is most appropriate?

Use the system's built-in backup utility to create a full backup.

Only image the hard drive, because it contains the most evidence.

Ask the user to close all applications and then shut down the system.

Immediately capture memory, then record network connections and process lists, and then image the disk.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 1)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 1–5

1application · medium
A forensic examiner is performing a live acquisition on a compromised server. The examiner uses a trusted tool on a USB drive and records the time and date of each command. Which additional action is most important for maintaining chain of custody?
Select an answer first
2application · medium
A forensic examiner is called to a site where a server is suspected of being compromised. The server is running and the examiner wants to preserve evidence. Which statement BEST describes the purpose of host-based live acquisition?
Select an answer first
3expert · hard
A forensic responder is called to a Windows server that is suspected of being compromised by a rootkit. The responder has a trusted USB toolkit but is concerned that the rootkit may be hiding processes and network connections. The responder must decide whether to trust the live system's API or use lower-level methods. Which approach is most defensible?
Select an answer first
4foundation · easy
Which command-line tool is commonly used on Windows to list running processes during a live acquisition?
Select an answer first
5expert · hard
A responder is collecting evidence from a live system that is suspected of being used for child exploitation. The responder has a warrant and must collect evidence that will hold up in court. The system is running Windows 10 and the user is actively using it. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Host Based Live Acquisition GBFA Practice Questions (Page 1)

Questions 1–5

A forensic examiner is performing a live acquisition on a compromised server. The examiner uses a trusted tool on a USB drive and records the time and date of each command. Which additional action is most important for maintaining chain of custody?

A forensic examiner is called to a site where a server is suspected of being compromised. The server is running and the examiner wants to preserve evidence. Which statement BEST describes the purpose of host-based live acquisition?

Which command-line tool is commonly used on Windows to list running processes during a live acquisition?

A responder is collecting evidence from a live system that is suspected of being used for child exploitation. The responder has a warrant and must collect evidence that will hold up in court. The system is running Windows 10 and the user is actively using it. Which action is most appropriate?

Keep studying — Acquisition Techniques