A Windows workstation is suspected of running a malicious executable that was downloaded from the internet. During manual triage, which combination of artifacts would most efficiently confirm execution and the origin of the file?

Prefetch files and browser download history

Registry userassist keys and Windows event logs

Windows search history and recent files

System restore points and shadow copies

In digital forensics, what is the primary purpose of manual triage?

To permanently preserve all data on the system by powering it down immediately.

To create a forensic image of the entire hard drive before any analysis begins.

To quickly identify and prioritize the most relevant evidence sources based on the examiner's initial assessment.

To automate the collection of all data from a suspect device without examiner intervention.

You are performing manual triage on a Linux system that is suspected of being used as a jump host. You need to determine if there are active SSH connections and what commands were run. However, the system has limited disk space and you cannot install new tools. Which approach is most effective?

Install tcpdump to capture network traffic for later analysis.

Copy the entire /var/log directory to a USB drive.

Use built-in commands like 'ss', 'ps', and 'history' to gather information, and redirect output to a mounted external drive.

Run 'find / -name '*.log' -exec cat {} \;' to view all logs.

During triage of a Windows system, you find a suspicious process running. You need to determine if it is malware. Which combination of evidence would be most useful to make this determination?

The user's desktop wallpaper and screensaver settings

The system's BIOS version and manufacturer

The amount of free disk space on the system

The process's executable path, its network connections, and the parent process ID

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 1)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 1–5

1application · medium
A Windows workstation is suspected of running a malicious executable that was downloaded from the internet. During manual triage, which combination of artifacts would most efficiently confirm execution and the origin of the file?
Select an answer first
2foundation · easy
In digital forensics, what is the primary purpose of manual triage?
Select an answer first
3expert · hard
You are performing manual triage on a Linux system that is suspected of being used as a jump host. You need to determine if there are active SSH connections and what commands were run. However, the system has limited disk space and you cannot install new tools. Which approach is most effective?
Select an answer first
4foundation · easy
Which forensic artifact is most likely to contain a record of websites visited by a user?
Select an answer first
5expert · hard
During triage of a Windows system, you find a suspicious process running. You need to determine if it is malware. Which combination of evidence would be most useful to make this determination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.