Remote Acquisition GBFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   During a remote acquisition, the connection drops repeatedly. What is the most likely cause?

   • ANetwork instability or firewall settings that are terminating the connection.
   • BThe forensic tool is not compatible with the remote operating system.
   • CThe remote system is running out of disk space.
   • DThe remote system is infected with malware that is disrupting the network.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which scenario best describes a remote acquisition in a forensic context?

   • AAn examiner connects to a suspect's computer over the network using a forensic agent to create a disk image.
   • BAn examiner uses a USB drive to boot a forensic tool on the target machine.
   • CAn examiner removes the hard drive from a computer and connects it to a write blocker in the lab.
   • DAn examiner requests a cloud provider to export a virtual machine disk image.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic team needs to remotely acquire data from a Windows server that is part of an Active Directory domain. The team has a dedicated forensic account with the necessary privileges. The acquisition must be performed over the network without physical access. Which tool is best suited for this task?

   • AA network mapping tool that enumerates open ports and services.
   • BA remote desktop tool that allows the examiner to manually browse files and copy them.
   • CA remote forensic agent that runs as a service and streams data to a forensic workstation over an encrypted channel.
   • DA vulnerability scanner that checks for missing patches.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which network-based method is commonly used to acquire data from a remote system in a forensically sound manner?

   • AUsing a network scanner to enumerate open ports and services.
   • BDeploying a remote forensic agent on the target system that streams data to the examiner's workstation.
   • CUsing remote desktop protocol (RDP) to view the screen and manually copy data.
   • DUsing a standard file-sharing protocol like SMB to copy files from the target system.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident responder needs to capture volatile data from a remote Windows server that is experiencing a ransomware infection. The server is critical and cannot be taken offline. The responder has remote administrative access. The ransomware is actively encrypting files. Which approach best balances the need for evidence preservation and system availability?

   • APower off the server immediately to stop the ransomware and then acquire the disk.
   • BImmediately capture a memory dump using a remote memory acquisition tool, then capture network connections and running processes.
   • CRun a full disk image first, then capture memory.
   • DDisconnect the server from the network and then capture memory.
   Reveal Solution Discussion Select an answer first