During a live acquisition of a Linux server, the responder needs to capture system state information that will help identify an active intrusion. Which set of data should be collected to provide the most comprehensive snapshot of current activity?

Installed software list, system uptime, and disk usage.

Running processes, active network connections, and open files.

User login history, cron jobs, and system logs.

Kernel version, hostname, and time zone.

Which of the following is considered volatile data that requires live acquisition?

The file system metadata of the C: drive

The contents of the system's page file

The registry hives stored in the Windows folder

The list of active network connections

A forensic team is preparing to acquire evidence from a live Windows server. They have limited time before the system must be rebooted. Which collection order best preserves the most volatile data first?

Open files, process list, network connections, memory dump.

Process list, open files, network connections, memory dump.

Network connections, memory dump, process list, open files.

Memory dump, network connections, process list, open files.

A responder is performing a memory acquisition on a Windows system using FTK Imager. The responder wants to ensure the memory image is not corrupted and can be verified later. Which step is essential?

Compress the memory image to save space.

Run the acquisition tool from the suspect system's hard drive.

Store the image on the same drive as the operating system.

Generate a hash of the memory image after acquisition and record it in the case notes.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 3)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 11–15

11application · medium
During a live acquisition of a Linux server, the responder needs to capture system state information that will help identify an active intrusion. Which set of data should be collected to provide the most comprehensive snapshot of current activity?
Select an answer first
12foundation · easy
Which of the following is considered volatile data that requires live acquisition?
Select an answer first
13application · medium
A forensic team is preparing to acquire evidence from a live Windows server. They have limited time before the system must be rebooted. Which collection order best preserves the most volatile data first?
Select an answer first
14application · easy
You are performing live acquisition on a Windows system and need to capture the list of open files. Which built-in tool can provide this information?
Select an answer first
15application · medium
A responder is performing a memory acquisition on a Windows system using FTK Imager. The responder wants to ensure the memory image is not corrupted and can be verified later. Which step is essential?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.