Manual Triage GBFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are triaging a laptop belonging to an employee accused of leaking sensitive documents. The investigation goal is to determine if confidential files were copied to external media. Which evidence source should you prioritize?

   • AThe pagefile.sys file
   • BThe system's event logs for logon events
   • CPrefetch files for the word processor application
   • DUSB device history in the Windows registry (SetupAPI and MountedDevices keys)
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   You are conducting manual triage on a compromised server and have collected several files of volatile data. Which practice is essential to maintain chain of custody?

   • AEmail the collected files to yourself for backup.
   • BKeep the files on the original system until the investigation is complete.
   • CLabel each collected file with a unique identifier, record who collected it and when, and store it in a secure location.
   • DOnly document the commands you ran, not the output files.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are triaging a Windows system and need to determine if a specific user account was used to log on remotely. Which artifact would provide the most direct evidence?

   • AThe Security event log with logon type 10 (RemoteInteractive)
   • BThe browser history for the user
   • CThe registry's UserAssist keys
   • DThe Prefetch files for the system
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are triaging a system that is suspected of being used to access illegal content. The investigation goal is to determine user activity. You have limited time and must choose between examining browser history or the system's pagefile. Which is the better triage decision?

   • AExamine the pagefile first because it may contain deleted browser history.
   • BExamine browser history first because it directly records user web activity.
   • CExamine the registry's UserAssist keys instead of browser history.
   • DExamine both simultaneously to save time.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During live triage of a Windows system, you find a process that is using a network connection to an IP address known to be a command-and-control server. The process is critical to the system's operation and cannot be stopped. What is the best triage action?

   • ATerminate the process to stop the communication.
   • BDocument the process details and network connection, then check for associated files and persistence mechanisms.
   • CIsolate the system from the network by unplugging the cable.
   • DImmediately block the IP address in the firewall.
   Reveal Solution Discussion Select an answer first