During triage of a Windows workstation, you have limited time and must choose which artifacts to collect. The investigation is about potential malware infection. Which combination of artifacts should you prioritize?

Prefetch files, the Run registry keys, and the Windows Event Logs for process creation

Browser history, cookies, and downloaded files

The user's document files and desktop shortcuts

The pagefile.sys and hiberfil.sys files

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 11)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 51–51

51expert · hard
During triage of a Windows workstation, you have limited time and must choose which artifacts to collect. The investigation is about potential malware infection. Which combination of artifacts should you prioritize?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Manual Triage GBFA Practice Questions (Page 11)

Questions 51–51

During triage of a Windows workstation, you have limited time and must choose which artifacts to collect. The investigation is about potential malware infection. Which combination of artifacts should you prioritize?

Keep studying — Triage and Manual Analysis