You are conducting manual triage and have collected volatile data from a system. You need to hand the evidence over to another investigator. Which step is essential to maintain chain of custody?

Place the evidence in a shared network drive accessible to the investigator.

Send the evidence via encrypted email to the investigator.

Document the transfer in a chain-of-custody log with signatures and timestamps.

Describe the evidence verbally to the investigator.

You are triaging a Windows system where a user is suspected of visiting malicious websites. Which artifact would provide the most direct evidence of the user's browsing activity?

The Windows Registry key for user login times

Browser history files (e.g., History, Places.sqlite, or Cookies)

You are performing manual triage on a live Windows system. The system is running critical business services and cannot be shut down. You need to collect volatile data while minimizing impact. Which approach best balances forensic soundness and operational continuity?

Run a full disk image while the system is running.

Copy the entire memory to a network share using a third-party tool.

Take a snapshot of the virtual machine from the hypervisor.

Use built-in tools to capture process and network information, and document the commands and output hashes.

You have 30 minutes to triage a server that may have been compromised. The incident response team needs to know if the attacker is still active and what data may have been accessed. Which approach best aligns with manual triage principles?

Start by capturing running processes, network connections, and logged-on users, then examine high-value artifacts.

Collect a full memory dump and disk image before any analysis.

Run a full antivirus scan and wait for the results.

Interview all users who have access to the server before examining the system.

You are triaging a system involved in a malware outbreak. You have limited time and need to determine the scope of the infection. Which evidence source should you prioritize?

Running processes and network connections

Browser history and recent files

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 8)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 36–40

36expert · hard
You are conducting manual triage and have collected volatile data from a system. You need to hand the evidence over to another investigator. Which step is essential to maintain chain of custody?
Select an answer first
37application · medium
You are triaging a Windows system where a user is suspected of visiting malicious websites. Which artifact would provide the most direct evidence of the user's browsing activity?
Select an answer first
38expert · hard
You are performing manual triage on a live Windows system. The system is running critical business services and cannot be shut down. You need to collect volatile data while minimizing impact. Which approach best balances forensic soundness and operational continuity?
Select an answer first
39application · medium
You have 30 minutes to triage a server that may have been compromised. The incident response team needs to know if the attacker is still active and what data may have been accessed. Which approach best aligns with manual triage principles?
Select an answer first
40expert · hard
You are triaging a system involved in a malware outbreak. You have limited time and need to determine the scope of the infection. Which evidence source should you prioritize?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.