Why is the trustworthiness of tools used in live acquisition a concern?

Because the tools may be compromised by malware on the system

Because the tools are not widely available

Because the tools are often too slow to capture volatile data

Because the tools cannot run on all operating systems

During a live acquisition of a compromised web server, the responder needs to capture the current state of the system to determine if an attacker is still active. Which command output would be most useful to capture FIRST?

The list of active network connections (e.g., netstat -an).

The contents of the /etc/passwd file.

The list of installed packages.

A forensic responder arrives at a workstation where a suspected data exfiltration is ongoing. The user is still logged in, and the system is responsive. The responder must prioritize collection to minimize loss of volatile data. Which sequence best follows the order of volatility?

Capture RAM, then record network connections, then list processes, then copy the page file.

Record network connections, then copy the page file, then capture RAM, then list processes.

Copy the page file first, then capture RAM, then list processes, then record network connections.

List processes, then capture RAM, then record network connections, then copy the page file.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 9)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 41–45

41foundation · easy
On a Linux system, which command is commonly used to create a raw memory dump for forensic analysis?
Select an answer first
42foundation · easy
Why is the trustworthiness of tools used in live acquisition a concern?
Select an answer first
43application · medium
During a live acquisition, you have limited time and must prioritize what to collect. Which of the following items should be collected FIRST according to the order of volatility?
Select an answer first
44application · medium
During a live acquisition of a compromised web server, the responder needs to capture the current state of the system to determine if an attacker is still active. Which command output would be most useful to capture FIRST?
Select an answer first
45application · medium
A forensic responder arrives at a workstation where a suspected data exfiltration is ongoing. The user is still logged in, and the system is responsive. The responder must prioritize collection to minimize loss of volatile data. Which sequence best follows the order of volatility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Host Based Live Acquisition GBFA Practice Questions (Page 9)

Questions 41–45

On a Linux system, which command is commonly used to create a raw memory dump for forensic analysis?

Why is the trustworthiness of tools used in live acquisition a concern?

During a live acquisition, you have limited time and must prioritize what to collect. Which of the following items should be collected FIRST according to the order of volatility?

During a live acquisition of a compromised web server, the responder needs to capture the current state of the system to determine if an attacker is still active. Which command output would be most useful to capture FIRST?

A forensic responder arrives at a workstation where a suspected data exfiltration is ongoing. The user is still logged in, and the system is responsive. The responder must prioritize collection to minimize loss of volatile data. Which sequence best follows the order of volatility?

Keep studying — Acquisition Techniques