If a remote acquisition fails because the target system is not reachable, what is the first troubleshooting step?

Reinstall the forensic agent on the target system.

Switch to a different forensic tool.

Verify network connectivity using ping or other network diagnostic tools.

An examiner needs to image a remote server's disk over a network. The server is running a critical database and cannot be shut down. The examiner has remote administrative access. The database is actively writing to the disk. Which approach is most appropriate to obtain a forensically sound image?

Perform a logical backup of the database files using the database's native backup tool.

Perform a live acquisition using dd while the system is running, accepting that the image may be inconsistent.

Use a snapshot-based imaging tool that creates a consistent point-in-time image of the disk while the system is running.

Stop the database service, then run dd to image the disk, and restart the service afterward.

When should the hash of a remotely acquired image be calculated to ensure its integrity?

Only after the acquisition to confirm the image is not corrupted.

Both before and after the acquisition to compare and confirm the copy is exact.

Only if the image is transferred over an insecure network.

Only before the acquisition to document the source state.

An incident response team is acquiring a forensic image from a remote Linux server over an SSH tunnel. The imaging tool writes the image directly to a network share. After the acquisition completes, the team needs to verify the integrity of the image. Which step is most appropriate?

Check that the file size matches the expected size of the source disk.

Compare the SHA-256 hash of the image file on the network share with the hash computed by the imaging tool during acquisition.

Open the image in a forensic tool and confirm that the filesystem is readable.

Re-run the acquisition a second time and compare the two image files byte-for-byte.

A forensic examiner needs to capture volatile data from a remote Windows system that is currently running. The system is suspected of hosting an active malware process. The examiner has remote administrative access over an encrypted channel. Which action should be taken FIRST?

Capture the contents of RAM using a remote memory acquisition tool.

List running processes and save the output to a file.

Run a network packet capture to monitor the malware's communication.

Copy the pagefile.sys to a network share.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 3

Remote Acquisition GBFA Practice Questions (Page 2)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

Questions 6–10

6foundation · medium
If a remote acquisition fails because the target system is not reachable, what is the first troubleshooting step?
Select an answer first
7expert · hard
An examiner needs to image a remote server's disk over a network. The server is running a critical database and cannot be shut down. The examiner has remote administrative access. The database is actively writing to the disk. Which approach is most appropriate to obtain a forensically sound image?
Select an answer first
8foundation · medium
When should the hash of a remotely acquired image be calculated to ensure its integrity?
Select an answer first
9application · medium
An incident response team is acquiring a forensic image from a remote Linux server over an SSH tunnel. The imaging tool writes the image directly to a network share. After the acquisition completes, the team needs to verify the integrity of the image. Which step is most appropriate?
Select an answer first
10application · medium
A forensic examiner needs to capture volatile data from a remote Windows system that is currently running. The system is suspected of hosting an active malware process. The examiner has remote administrative access over an encrypted channel. Which action should be taken FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.