A forensic analyst is about to perform a live acquisition on a Windows system. The analyst is concerned that running the acquisition tool may alter the system state. Which action best mitigates this concern?

Use a trusted, statically compiled tool from a read-only medium and document all commands executed.

Disable the write filter on the system to allow the tool to run smoothly.

Use the latest version of the tool downloaded directly onto the suspect system.

Run the tool from the suspect system's hard drive to ensure compatibility.

A junior analyst is about to perform live acquisition on a compromised Windows server. The analyst wants to use a tool that is already installed on the suspect system. Why is this a concern?

The tool will automatically overwrite the memory it is trying to capture.

The tool may be trojanized or modified by the attacker, leading to unreliable results.

The tool may not be compatible with the system's architecture.

The tool will trigger an antivirus alert and alert the attacker.

What is a major challenge of host-based live acquisition?

It requires the system to be powered off

It only captures data from the hard drive

It can alter the state of the system being investigated

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 2)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 6–10

6application · easy
During a live acquisition on a Windows system, you need to capture the current state of network connections and running processes. Which commands should you run?
Select an answer first
7foundation · easy
Which command is used on Windows to capture the current network connections and listening ports during live acquisition?
Select an answer first
8application · medium
A forensic analyst is about to perform a live acquisition on a Windows system. The analyst is concerned that running the acquisition tool may alter the system state. Which action best mitigates this concern?
Select an answer first
9application · medium
A junior analyst is about to perform live acquisition on a compromised Windows server. The analyst wants to use a tool that is already installed on the suspect system. Why is this a concern?
Select an answer first
10foundation · easy
What is a major challenge of host-based live acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Host Based Live Acquisition GBFA Practice Questions (Page 2)

Questions 6–10

During a live acquisition on a Windows system, you need to capture the current state of network connections and running processes. Which commands should you run?

Which command is used on Windows to capture the current network connections and listening ports during live acquisition?

A forensic analyst is about to perform a live acquisition on a Windows system. The analyst is concerned that running the acquisition tool may alter the system state. Which action best mitigates this concern?

A junior analyst is about to perform live acquisition on a compromised Windows server. The analyst wants to use a tool that is already installed on the suspect system. Why is this a concern?

What is a major challenge of host-based live acquisition?

Keep studying — Acquisition Techniques