A forensic examiner needs to transfer a large forensic image from a remote Linux server to a forensic workstation over the internet. The image contains sensitive data and must be protected from interception. The examiner also needs to verify the image's integrity after transfer. Which method should be used?

Use a USB drive to physically transport the image, but do not hash it.

Use FTP to transfer the image and then compare file sizes.

Use SCP to transfer the image and then calculate a hash on the workstation to compare with the source hash.

Use HTTP to download the image and rely on the server's SSL certificate.

A forensic examiner is planning to acquire data from a remote server that is located in another country. The examiner's organization is based in the United States, and the server is in the European Union. The data on the server includes personal data of EU citizens. Which consideration is most important before proceeding?

Confirm that the network bandwidth is sufficient for the transfer.

Verify that the server's operating system is supported by the imaging tool.

Ensure that the remote acquisition complies with the EU's data protection regulations, including cross-border data transfer rules.

Obtain a warrant from a US court before acquiring the data.

Which of the following is a secure channel commonly used for remote forensic acquisition?

HTTP (Hypertext Transfer Protocol)

A corporate investigator needs to remotely acquire data from an employee's laptop that is connected to the corporate network. The employee is under investigation for policy violations, not criminal activity. The company's acceptable use policy states that the company may access and acquire data from company-owned devices for investigation purposes. The laptop is company-owned and the employee signed the policy. Which action is most appropriate?

Obtain a search warrant before acquiring any data, because the employee has a reasonable expectation of privacy.

Acquire only the data that is directly related to the investigation and avoid any personal files.

Proceed with remote acquisition because the company owns the device and the policy provides consent.

Ask the employee for verbal consent before proceeding.

A forensic examiner needs to remotely acquire data from a macOS system that is located in a remote office. The examiner has administrative credentials and wants to use a tool that can capture a logical image and also collect volatile data. The transmission must be encrypted. Which tool is most appropriate?

Use a commercial forensic tool that supports remote acquisition via an encrypted agent.

Use FTP to download the user's home directory and then run 'ps' and 'netstat' manually.

Use a network share to copy the entire hard drive to a server.

Use the built-in 'dd' command over SSH to create a raw image of the entire disk.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 3

Remote Acquisition GBFA Practice Questions (Page 4)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

Questions 16–20

16application · medium
A forensic examiner needs to transfer a large forensic image from a remote Linux server to a forensic workstation over the internet. The image contains sensitive data and must be protected from interception. The examiner also needs to verify the image's integrity after transfer. Which method should be used?
Select an answer first
17application · medium
A forensic examiner is planning to acquire data from a remote server that is located in another country. The examiner's organization is based in the United States, and the server is in the European Union. The data on the server includes personal data of EU citizens. Which consideration is most important before proceeding?
Select an answer first
18foundation · medium
Which of the following is a secure channel commonly used for remote forensic acquisition?
Select an answer first
19expert · hard
A corporate investigator needs to remotely acquire data from an employee's laptop that is connected to the corporate network. The employee is under investigation for policy violations, not criminal activity. The company's acceptable use policy states that the company may access and acquire data from company-owned devices for investigation purposes. The laptop is company-owned and the employee signed the policy. Which action is most appropriate?
Select an answer first
20application · medium
A forensic examiner needs to remotely acquire data from a macOS system that is located in a remote office. The examiner has administrative credentials and wants to use a tool that can capture a logical image and also collect volatile data. The transmission must be encrypted. Which tool is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Remote Acquisition GBFA Practice Questions (Page 4)

Questions 16–20

Which of the following is a secure channel commonly used for remote forensic acquisition?

Keep studying — Acquisition Techniques