What is the first step in the mobile device triage process?

Connect the device to a forensic workstation

Extract call logs and text messages

Place the device in a Faraday bag or enable airplane mode

Document the device's physical condition and state

An examiner is triaging a smartphone in a terrorism investigation. The device is unlocked, but the examiner has only 10 minutes before the device auto-locks. The case requires immediate identification of co-conspirators and their locations. The examiner must choose between extracting the full filesystem or focusing on specific data. Which approach is most likely to yield the critical evidence within the time limit?

Perform a full filesystem extraction using a commercial tool.

Use a triage tool to extract call logs, SMS/MMS, and GPS location history.

Quickly capture screenshots of messaging apps and mapping applications.

Disable the auto-lock feature and then perform a full acquisition.

A corporate investigator is conducting triage on a company-issued smartphone belonging to a terminated employee. The employee's personal messages are visible on the device. The investigation is for suspected data exfiltration. What is the most appropriate legal consideration before extracting data?

Proceed with extraction because the device is company property

Review the company's acceptable use policy and consent agreements to determine the scope of authorized access

Extract only work-related data and ignore personal messages

Contact law enforcement to obtain a warrant before any extraction

A forensic examiner is conducting triage on a mobile device that is evidence in a civil litigation case. The device belongs to a third party, not the defendant. The examiner has been asked to extract data. What is the most important legal consideration?

Ask the third party for consent to extract the data

Extract only data that is directly related to the litigation

Proceed with extraction because the device is relevant to the case

Obtain proper legal authorization, such as a subpoena or court order, before accessing the device

In a fraud investigation, an examiner has a smartphone that is unlocked. The examiner must quickly capture evidence of the suspect's financial transactions. Which data source should be prioritized during triage?

Device firmware version and build number

Banking and payment app data, including transaction history and account details

Social media messages and contacts

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 5)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 21–25

21foundation · easy
What is the first step in the mobile device triage process?
Select an answer first
22expert · hard
An examiner is triaging a smartphone in a terrorism investigation. The device is unlocked, but the examiner has only 10 minutes before the device auto-locks. The case requires immediate identification of co-conspirators and their locations. The examiner must choose between extracting the full filesystem or focusing on specific data. Which approach is most likely to yield the critical evidence within the time limit?
Select an answer first
23application · medium
A corporate investigator is conducting triage on a company-issued smartphone belonging to a terminated employee. The employee's personal messages are visible on the device. The investigation is for suspected data exfiltration. What is the most appropriate legal consideration before extracting data?
Select an answer first
24application · medium
A forensic examiner is conducting triage on a mobile device that is evidence in a civil litigation case. The device belongs to a third party, not the defendant. The examiner has been asked to extract data. What is the most important legal consideration?
Select an answer first
25application · medium
In a fraud investigation, an examiner has a smartphone that is unlocked. The examiner must quickly capture evidence of the suspect's financial transactions. Which data source should be prioritized during triage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.