According to the order of volatility, which data should be collected FIRST during live acquisition?

The contents of CPU registers and cache

The contents of the system's RAM

The list of active network connections

An incident responder needs to capture the memory of a Linux server that is experiencing a kernel panic. The system is still partially responsive. Which tool is most appropriate for this task?

Use WinPmem to capture the memory.

Use the /dev/mem device with dd to create a raw memory image.

Use the 'memdump' command from the sysstat package.

Use FTK Imager to create a memory dump.

You are the lead forensic examiner in a case involving a compromised database server. You have completed a live acquisition and need to ensure the evidence is admissible in court. Which action is MOST important to maintain the chain of custody?

Make multiple copies of the evidence for analysis.

Store the evidence in a locked drawer in your office.

Encrypt the evidence with a strong password.

Document every person who handled the evidence and when.

You are performing live acquisition on a Windows system and need to capture both memory and a list of running processes. Which combination of tools would you use?

WinPmem for memory and tasklist for processes

WinPmem for processes and tasklist for memory

dd for memory and netstat for processes

FTK Imager for memory and ipconfig for processes

A forensic examiner is performing a memory acquisition on a Linux server using dd to read /dev/mem. The acquisition is slow, and the examiner is concerned about the system changing during the capture. Which technique can help minimize the impact of system changes during acquisition?

Use the 'sync' command before starting to ensure the system is stable.

Pause all running processes during the acquisition.

Use dd with a larger block size to speed up the read.

Use a tool that snapshots memory in a single pass, such as LiME, which loads a kernel module to capture memory quickly.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 7)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 31–35

31foundation · easy
According to the order of volatility, which data should be collected FIRST during live acquisition?
Select an answer first
32application · medium
An incident responder needs to capture the memory of a Linux server that is experiencing a kernel panic. The system is still partially responsive. Which tool is most appropriate for this task?
Select an answer first
33application · medium
You are the lead forensic examiner in a case involving a compromised database server. You have completed a live acquisition and need to ensure the evidence is admissible in court. Which action is MOST important to maintain the chain of custody?
Select an answer first
34application · medium
You are performing live acquisition on a Windows system and need to capture both memory and a list of running processes. Which combination of tools would you use?
Select an answer first
35expert · hard
A forensic examiner is performing a memory acquisition on a Linux server using dd to read /dev/mem. The acquisition is slow, and the examiner is concerned about the system changing during the capture. Which technique can help minimize the impact of system changes during acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.