Host Based Live Acquisition GBFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are performing memory acquisition on a Linux system using dd to read /dev/mem. The acquisition is taking longer than expected and the system is under heavy load. What is the most likely impact on the forensic soundness of the memory image?

   • AThe image will be smaller than the actual RAM size.
   • BThe image may be inconsistent because memory is changing while being read.
   • CThe image will be corrupted and unusable for analysis.
   • DThe image will be perfectly consistent because dd reads sequentially.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   You are performing live acquisition on a compromised Linux server. The system is heavily loaded and you have limited time. You must choose between capturing memory, network connections, or running processes. Which should you capture FIRST?

   • AOpen files
   • BRunning processes
   • CMemory
   • DNetwork connections
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which tool is specifically designed to capture the contents of a system's memory for forensic analysis?

   • Anetstat
   • Bipconfig
   • CWinPmem
   • Dtasklist
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manager asks why you are performing live acquisition instead of simply pulling the plug and imaging the hard drive. Which is the BEST justification for live acquisition?

   • ALive acquisition is required by law in all cases.
   • BLive acquisition is faster than imaging a hard drive.
   • CLive acquisition preserves volatile data that would be lost on shutdown.
   • DLive acquisition does not alter the system at all.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are performing live memory acquisition on a Windows 10 workstation using WinPmem. The system has 16 GB of RAM and the target drive is nearly full. What is the most appropriate way to store the memory image while maintaining forensic integrity?

   • ASave the image to the system's existing hard drive in a temporary folder.
   • BStream the image over the network to a forensic server using an unencrypted connection.
   • CWrite the image directly to a forensically clean USB 3.0 drive that has been write-protected.
   • DCompress the image on the fly and store it on the same partition as the operating system.
   Reveal Solution Discussion Select an answer first