A forensic examiner is triaging a smartphone that is currently in a call with a suspected accomplice. The device is unlocked and the call is ongoing. The examiner needs to preserve evidence without alerting the suspect. What is the best immediate action?

Remove the battery to force a shutdown.

End the call immediately and then place the device in airplane mode.

Connect the device to a forensic workstation to capture the call data.

Photograph the screen showing the call in progress, then place the device in airplane mode.

After securing a mobile device from network access, what is the next logical step in the triage process?

Power off the device immediately

Perform a logical extraction of all data

Document the device's make, model, and condition

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 8)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 36–37

36expert · hard
A forensic examiner is triaging a smartphone that is currently in a call with a suspected accomplice. The device is unlocked and the call is ongoing. The examiner needs to preserve evidence without alerting the suspect. What is the best immediate action?
Select an answer first
37foundation · easy
After securing a mobile device from network access, what is the next logical step in the triage process?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Mobile Device Triage GBFA Practice Questions (Page 8)

Questions 36–37

A forensic examiner is triaging a smartphone that is currently in a call with a suspected accomplice. The device is unlocked and the call is ongoing. The examiner needs to preserve evidence without alerting the suspect. What is the best immediate action?

After securing a mobile device from network access, what is the next logical step in the triage process?

Keep studying — Mobile and Specialty Devices