Manual Triage GBFA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You are triaging a Windows system and need to quickly identify which programs have been run recently. Which artifact is most efficient for this purpose?

   • AThe Windows event log
   • BThe registry's Run keys
   • CThe browser history
   • DThe Prefetch folder
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You are the first responder at a suspected data breach. The compromised system is a critical production server that cannot be taken offline. What is the most appropriate manual triage approach?

   • APerform live triage by collecting volatile data while the system remains running.
   • BDisconnect the server from the network and then image the disk.
   • CImmediately shut down the server to preserve evidence.
   • DWait until a maintenance window to perform a full forensic image.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In a case involving suspected unauthorized access to a corporate network, which evidence source would likely be the highest priority during manual triage?

   • AThe suspect's desktop wallpaper image
   • BThe suspect's music files
   • CThe suspect's personal photo collection
   • DThe suspect's web browser history
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary reason for collecting volatile data before non-volatile data during manual triage?

   • AVolatile data is more important than non-volatile data.
   • BNon-volatile data is too large to collect quickly.
   • CVolatile data is easier to collect.
   • DVolatile data is lost when the system loses power.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   You are leading a manual triage of a compromised server. The organization's legal team requires that all evidence be collected in a manner that preserves its integrity for potential litigation. However, the server is business-critical and cannot be shut down for more than 15 minutes. Which approach best balances these constraints?

   • APerform a live triage, collecting volatile data first, then create a forensic image of the disk while the system is still running.
   • BOnly collect a memory dump and skip disk imaging to save time.
   • CShut down the server immediately and create a full forensic image of the disk.
   • DCopy only the most relevant files to an external drive and skip volatile data collection.
   Reveal Solution Discussion Select an answer first