Manual Triage GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   You are documenting your manual triage findings. Which practice best ensures the chain of custody is maintained?

   • AOnly document final conclusions, not intermediate steps.
   • BShare your notes with other team members without a formal handover.
   • CRecord every action taken, including commands run and timestamps, in a detailed log.
   • DKeep all notes in your memory and write them up after the investigation.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are performing manual triage on a system that is suspected of being compromised. The system is running and you have limited time. Which action is most important to do first?

   • AImage the hard drive
   • BCheck the event logs
   • CRecord the system time
   • DCapture the system's memory
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which statement best describes the role of manual triage in a digital forensics investigation?

   • AIt is a fully automated process that requires no examiner input.
   • BIt replaces the need for a full forensic image in all cases.
   • CIt is the final step in the forensic process where a report is generated.
   • DIt helps the examiner focus resources on the most probative evidence early in the investigation.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are performing manual triage on a live Linux server suspected of being compromised. You need to collect volatile data while preserving its evidentiary value. Which sequence of actions best follows forensic soundness principles?

   • ARun a full disk image first, then collect volatile data from the running system.
   • BCollect only network connections and open files, because other volatile data is not admissible in court.
   • CRecord the current time and date, capture running processes and network connections, then hash the output files and document the commands used.
   • DPower off the system immediately to preserve the hard drive, then boot from a forensic live CD to collect data.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are triaging a Windows system involved in a data breach. The investigation goal is to determine if sensitive files were exfiltrated via email. You have limited time and must choose which artifacts to prioritize. Which combination of artifacts is most likely to provide the needed evidence?

   • ABrowser history and the registry's UserAssist keys
   • BEmail client artifacts (e.g., Outlook cache) and the user's recent files
   • CPrefetch files and the Windows event log
   • DNetwork connections and the firewall log
   Reveal Solution Discussion Select an answer first