Which of the following is an example of non-volatile data that would be collected during manual triage?

The list of active network connections

The system's registry hive files

During a manual triage of a compromised Windows workstation, you need to quickly identify whether an attacker is actively using the system. Which two commands or tools should you prioritize to assess current activity?

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run and wevtutil qe Security

dir C:\Users and type C:\Windows\System32\drivers\etc\hosts

A forensic examiner is triaging a system that is suspected of being used to access illegal content. The examiner has limited time and must decide which artifacts to collect. Which set of artifacts would provide the most comprehensive evidence of user activity?

The system's event logs for logon events only

Browser history, prefetch files, and the user's recent documents list

The registry keys for system time zone settings

In a Windows triage, you need to identify programs that automatically start when a user logs on. Which registry key should you examine?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

During initial assessment of a live system, which of the following would provide the most direct indication of active network communication?

The contents of the recycle bin

The current network connections

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 7)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 31–35

31foundation · easy
Which of the following is an example of non-volatile data that would be collected during manual triage?
Select an answer first
32application · medium
During a manual triage of a compromised Windows workstation, you need to quickly identify whether an attacker is actively using the system. Which two commands or tools should you prioritize to assess current activity?
Select an answer first
33expert · hard
A forensic examiner is triaging a system that is suspected of being used to access illegal content. The examiner has limited time and must decide which artifacts to collect. Which set of artifacts would provide the most comprehensive evidence of user activity?
Select an answer first
34application · medium
In a Windows triage, you need to identify programs that automatically start when a user logs on. Which registry key should you examine?
Select an answer first
35foundation · easy
During initial assessment of a live system, which of the following would provide the most direct indication of active network communication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.