Remote Acquisition GBFA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic examiner is asked to perform a remote acquisition of a cloud-hosted virtual machine that contains data belonging to a customer. The examiner has been given credentials by the cloud provider, but the customer has not been notified. The examiner's organization is in a jurisdiction that requires a court order for accessing third-party data. What should the examiner do?

   • ANotify the customer and ask for consent before proceeding.
   • BObtain a court order or other legal authorization before proceeding.
   • CProceed with the acquisition because the cloud provider gave credentials.
   • DPerform the acquisition and then seek legal approval afterward.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic examiner is asked to acquire data from a server that is located in a different city. The examiner cannot physically access the server, but has network access and authorization. The examiner needs to decide between remote acquisition and asking a local technician to perform a local acquisition. What is the primary advantage of remote acquisition in this scenario?

   • AIt is always faster than local acquisition.
   • BIt allows the examiner to acquire data without traveling to the remote location.
   • CIt eliminates the need for legal authorization.
   • DIt guarantees the data is not altered during acquisition.
   Reveal Solution Discussion Select an answer first
4. 38foundation · medium

   Why is it important to use encryption when transmitting forensic data during remote acquisition?

   • ATo protect the confidentiality of the data in transit from interception.
   • BTo increase the speed of the data transfer.
   • CTo compress the data to save bandwidth.
   • DTo ensure the data is not altered during transmission.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic examiner needs to acquire a logical image of a suspect's laptop that is currently connected to the corporate network. The laptop is running Windows 10 with BitLocker enabled, and the examiner has been granted written authorization from the legal department. The examiner wants to minimize the risk of altering the evidence and ensure the data is protected during transit. Which approach best meets these requirements?

   • AUse a remote forensic agent to capture a logical image of the encrypted volume while the system is running, and transmit the image over an encrypted TLS channel to the examiner's server.
   • BBoot the laptop from a forensic USB drive and create a physical image locally, then transfer the image file to the examiner's workstation using SCP.
   • CDisable BitLocker on the laptop, then use the built-in Windows backup tool to create a full system image and copy it to a network share.
   • DUse a network protocol like FTP to download the entire hard drive contents directly from the laptop to the examiner's workstation.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An examiner needs to create a forensic image of a remote Linux system's hard drive over a network. The examiner has root SSH access. The system is running and the drive is in use. Which approach is most appropriate?

   • AMount the drive as read-only and use a file-level copy tool.
   • BRun dd on the running system and pipe the output through SSH to the examiner's workstation.
   • CBoot the system into a live forensic environment via PXE and use dd over an SSH tunnel to send the image to the examiner's workstation.
   • DUse rsync to copy the entire filesystem to the examiner's workstation.
   Reveal Solution Discussion Select an answer first