Remote Acquisition GBFA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a remote acquisition of a large server disk over a WAN link, the imaging process fails after transferring about 60% of the data. The error log shows a 'connection reset by peer' message. The examiner needs to complete the acquisition without restarting from scratch. Which approach is most appropriate?

   • ASwitch to a different network protocol, such as FTP, and restart the acquisition.
   • BRestart the acquisition from the beginning, but first increase the TCP timeout settings on the imaging tool.
   • CUse a tool that supports checkpointing and resume, then resume the acquisition from the last completed block.
   • DCapture the remaining data by performing a logical file copy over the network.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An incident responder must capture volatile data from a remote Windows server that is running a critical application. The responder has remote access via RDP and needs to collect memory, running processes, and network connections. The server cannot be rebooted, and the capture must have minimal impact on the application. Which approach is best?

   • AUse a network sniffer to capture traffic and infer the volatile data.
   • BUse a remote forensic agent that supports memory capture and run it with low priority.
   • CUse RDP to run 'taskmgr' and manually record the processes and connections.
   • DCreate a memory dump using the Windows 'crash' feature, which requires a reboot.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   What is the purpose of computing a hash of a remotely acquired forensic image?

   • ATo index the image for faster searching.
   • BTo encrypt the image for secure storage.
   • CTo verify the integrity of the image by ensuring it matches the original data.
   • DTo compress the image to save space.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   When imaging a remote system over a network, why is it important to use a write-blocking mechanism on the target system?

   • ATo speed up the network transfer of the image.
   • BTo prevent any data from being altered on the source system during acquisition.
   • CTo compress the image to save storage space.
   • DTo encrypt the image data during transmission.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An incident responder needs to capture volatile data from a remote Linux server that is suspected of being compromised. The responder has SSH access and needs to collect running processes, network connections, and memory contents. The data must be transmitted securely to a forensic workstation. Which approach should the responder take?

   • AUse a remote forensic agent that only captures static files and does not interact with running processes.
   • BPower off the server immediately and then remove the hard drive for imaging.
   • CSend the output of each command via unencrypted telnet to avoid adding extra software to the system.
   • DRun individual commands like 'ps', 'netstat', and 'dd' over SSH, redirecting output to a file on the forensic workstation.
   Reveal Solution Discussion Select an answer first