Remote Acquisition GBFA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · medium

   Which of the following is a volatile data item that should be captured first during a remote acquisition?

   • ANetwork connections and open ports
   • BUser documents
   • CSystem event logs
   • DRegistry hives
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A law enforcement officer requests a remote forensic acquisition of a company's email server to investigate an employee's alleged misconduct. The company is in a jurisdiction that requires a warrant for accessing stored communications. The officer has obtained a warrant, but the company's legal counsel asks whether the warrant is sufficient for remote acquisition. What is the primary legal consideration?

   • AThe warrant must specifically authorize remote acquisition and identify the data to be acquired.
   • BThe warrant is not needed because the company owns the server and can consent to the acquisition.
   • CThe warrant must be issued by a federal court, not a state court.
   • DRemote acquisition is always legal if the officer has probable cause.
   Reveal Solution Discussion Select an answer first
4. 28foundation · medium

   Which tool is specifically designed to provide read-only remote access to a computer's storage for forensic acquisition?

   • AF-Response
   • BMetasploit
   • CWireshark
   • DNmap
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   In a corporate investigation, which of the following is most likely to provide legal authorization for remote acquisition of an employee's company-issued computer?

   • AThe company's general IT security policy that mentions monitoring network traffic.
   • BA verbal request from the employee's manager.
   • CThe employee's personal email account credentials.
   • DThe employee's signed acceptable use policy that allows the company to monitor and access company devices.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic examiner is acquiring a remote system's image over an untrusted network. The examiner needs to ensure that the data is not intercepted or modified during transmission. Which method should be used?

   • AUse a plain FTP transfer to send the image to the examiner's workstation.
   • BEstablish a VPN tunnel between the examiner's workstation and the target system, then use a forensic imaging tool that supports encryption.
   • CUse a network share with read-only permissions.
   • DCompress the image with a password-protected ZIP file before transferring.
   Reveal Solution Discussion Select an answer first