You are performing manual triage on a Windows system that is part of an ongoing incident. The system is running and you need to collect volatile data. However, you are concerned about altering the system by running commands. Which approach minimizes the impact on the system while still collecting necessary data?

Use a third-party forensic tool that requires installation on the system.

Copy the entire Windows directory to an external drive.

Use built-in Windows commands and redirect output to an external forensic drive, avoiding writes to the local disk.

Run a full antivirus scan to ensure the system is clean before collecting data.

You have completed manual triage of a system and collected several files of evidence. You need to hand over the evidence to the investigating team. Which step is most critical to ensure the evidence remains admissible?

Email the files to the investigating team without any additional documentation.

Compress all files into a single archive to make transfer easier.

Store the files on the original system's hard drive until needed.

Create cryptographic hashes of all collected files and document the hash values in the chain of custody form.

You are the first responder at a suspected insider-threat incident. The organization wants to know if proprietary documents were copied to a USB drive. The system is on and the user is still logged in. What is the most appropriate manual triage action?

Ask the user to explain what they did, then record the conversation.

Check the USB device history in the registry and the user's recent files, then document the findings.

Immediately seize the USB ports by disabling them in Device Manager.

Run a full disk image and then analyze it later for USB activity.

Which of the following is a manual technique used to quickly assess a system's current state during triage?

Reviewing the system's running processes

Installing new security software

Performing a full disk defragmentation

During manual triage, which factor is most important when prioritizing potential evidence sources?

The age of the operating system

The likelihood that the source contains data relevant to the investigation's goals

The ease of access to the evidence source

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 1

Manual Triage GBFA Practice Questions (Page 9)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

6concepts

Questions 41–45

41expert · hard
You are performing manual triage on a Windows system that is part of an ongoing incident. The system is running and you need to collect volatile data. However, you are concerned about altering the system by running commands. Which approach minimizes the impact on the system while still collecting necessary data?
Select an answer first
42expert · hard
You have completed manual triage of a system and collected several files of evidence. You need to hand over the evidence to the investigating team. Which step is most critical to ensure the evidence remains admissible?
Select an answer first
43application · medium
You are the first responder at a suspected insider-threat incident. The organization wants to know if proprietary documents were copied to a USB drive. The system is on and the user is still logged in. What is the most appropriate manual triage action?
Select an answer first
44foundation · easy
Which of the following is a manual technique used to quickly assess a system's current state during triage?
Select an answer first
45foundation · easy
During manual triage, which factor is most important when prioritizing potential evidence sources?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.