During manual triage, you collect a list of running processes and save it to a text file. Which additional step is critical to preserve the integrity of this evidence?

Copy the file to the system's desktop for easy access.

Print the text file and store the printout in a safe.

Generate a cryptographic hash of the text file and record it in your notes.

Rename the file to include the date and time.

In a fraud investigation, you need to determine if a user accessed specific financial records on their workstation. Which evidence source should you prioritize during manual triage?

The system's prefetch files for all applications

The user's recent files and the Windows Search history

The network connections to the file server

During manual triage, what should be documented to maintain a proper chain of custody?

The brand of the computer being examined

The date, time, and location of evidence collection

The weather conditions on the day of collection

You are conducting manual triage on a Windows machine that is part of an active intrusion. You need to collect volatile data in a forensically sound manner. Which of the following is the most appropriate order for collecting data?

Running processes, then memory dump, then network connections, then disk image

Network connections, then running processes, then memory dump, then disk image

Disk image, then memory dump, then running processes, then network connections

Memory dump, then network connections, then running processes, then disk image

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 10)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 46–50

46application · medium
During triage of a Linux server, you need to quickly determine if an attacker is currently connected via SSH. Which command would you run first?
Select an answer first
47application · medium
During manual triage, you collect a list of running processes and save it to a text file. Which additional step is critical to preserve the integrity of this evidence?
Select an answer first
48application · medium
In a fraud investigation, you need to determine if a user accessed specific financial records on their workstation. Which evidence source should you prioritize during manual triage?
Select an answer first
49foundation · easy
During manual triage, what should be documented to maintain a proper chain of custody?
Select an answer first
50application · medium
You are conducting manual triage on a Windows machine that is part of an active intrusion. You need to collect volatile data in a forensically sound manner. Which of the following is the most appropriate order for collecting data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.