A forensic examiner needs to capture volatile data from a remote Linux server. The server is running a suspicious process that the examiner wants to analyze. The examiner has SSH access. Which data should be captured FIRST?

The contents of the /tmp directory.

The list of running processes and their command-line arguments.

The network connections and open sockets.

The contents of RAM using a memory acquisition tool.

What is the primary function of the 'dd' command when used in a remote acquisition context?

To create a bit-for-bit copy of a remote disk or partition by reading from a network-accessible source.

To verify the integrity of a remote file using MD5 hashes.

To encrypt data during transmission.

To scan the remote system for open ports and services.

A forensic examiner needs to image a remote Linux server over a slow WAN link. The server has 2 TB of data, but only 200 GB is likely relevant to the investigation. The examiner has authorization to acquire only relevant data. The imaging tool supports both physical and logical imaging, and the examiner wants to minimize network traffic while ensuring the evidence is admissible. Which approach is most appropriate?

Perform a full physical image of the entire disk and transfer it over the network.

Use a network protocol that compresses the data, but do not hash the image.

Perform a logical acquisition of only the relevant files and directories, and hash the acquired data.

Ask the server administrator to copy the relevant files to a network share and then download them.

What is the primary legal requirement for performing a remote acquisition of a computer system in a criminal investigation?

The system administrator must give verbal consent.

The system must be owned by the investigating agency.

A valid search warrant or court order authorizing the acquisition.

The system must be connected to a public network.

A forensic examiner needs to transfer a forensic image from a remote server to a workstation over an untrusted network. The examiner wants to ensure that the image is not intercepted and that its integrity is maintained. Which combination of methods should be used?

Use HTTP for the transfer and rely on the server's SSL certificate.

Use SCP for the transfer and calculate a hash after the transfer to compare with the source hash.

Use a VPN for the transfer and do not hash the image.

Use FTP for the transfer and compare file sizes.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 3

Remote Acquisition GBFA Practice Questions (Page 7)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

Questions 31–35

31application · medium
A forensic examiner needs to capture volatile data from a remote Linux server. The server is running a suspicious process that the examiner wants to analyze. The examiner has SSH access. Which data should be captured FIRST?
Select an answer first
32foundation · medium
What is the primary function of the 'dd' command when used in a remote acquisition context?
Select an answer first
33expert · hard
A forensic examiner needs to image a remote Linux server over a slow WAN link. The server has 2 TB of data, but only 200 GB is likely relevant to the investigation. The examiner has authorization to acquire only relevant data. The imaging tool supports both physical and logical imaging, and the examiner wants to minimize network traffic while ensuring the evidence is admissible. Which approach is most appropriate?
Select an answer first
34foundation · medium
What is the primary legal requirement for performing a remote acquisition of a computer system in a criminal investigation?
Select an answer first
35application · medium
A forensic examiner needs to transfer a forensic image from a remote server to a workstation over an untrusted network. The examiner wants to ensure that the image is not intercepted and that its integrity is maintained. Which combination of methods should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.