What is the primary purpose of maintaining a chain of custody for evidence collected during manual triage?

To ensure the evidence is stored in a secure location.

To reduce the amount of data collected.

To document every person who handled the evidence and when.

To make the evidence easier to analyze.

During manual triage, you collect a list of running processes by redirecting the output to a text file on a USB drive. What is the most important step to ensure this evidence is admissible?

Save the file with a descriptive filename such as 'process_list.txt'.

Email the file to your supervisor immediately.

Record the date, time, and your identity in a contemporaneous note, and later create a hash of the file.

Print the file and place it in a sealed evidence bag.

You are performing manual triage on a running Linux server suspected of unauthorized access. You need to collect volatile data while preserving its evidentiary value. Which action should you take first?

Run 'history' to see what commands the attacker executed.

Run 'date -u' and record the output, then capture running processes and network connections.

Immediately power off the server to preserve the hard drive.

Copy the entire hard drive using dd before touching anything else.

You are performing manual triage on a Windows machine that is part of an active ransomware investigation. The system is still running. Which collection order is most forensically sound?

Capture memory, then record network connections, then image the disk.

Image the disk first, then capture memory, then record network connections.

Record network connections, then image the disk, then capture memory.

Capture memory and image the disk simultaneously, then record network connections.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 2)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 6–10

6foundation · easy
What is the primary purpose of maintaining a chain of custody for evidence collected during manual triage?
Select an answer first
7application · medium
During manual triage, you collect a list of running processes by redirecting the output to a text file on a USB drive. What is the most important step to ensure this evidence is admissible?
Select an answer first
8application · medium
You are performing manual triage on a running Linux server suspected of unauthorized access. You need to collect volatile data while preserving its evidentiary value. Which action should you take first?
Select an answer first
9application · medium
You are performing manual triage on a Windows machine that is part of an active ransomware investigation. The system is still running. Which collection order is most forensically sound?
Select an answer first
10foundation · easy
Which of the following is a common forensic artifact that records the execution of applications on Windows systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.