Remote Acquisition GBFA Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   After completing a remote acquisition of a server's logical image, the examiner needs to verify that the image is an exact copy of the source data. The image was transferred over the network and the examiner has the original hash value from the source. Which step should the examiner take?

   • ACheck the file size of the image to ensure it matches the source size.
   • BOpen the image in a hex editor and visually compare it to the source.
   • CCalculate the hash of the acquired image and compare it to the original hash value.
   • DRe-run the acquisition and compare the two images.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A forensic examiner is attempting to remotely acquire a logical image from a Windows system using a remote agent. The agent connects, but the acquisition fails with a 'permission denied' error. The examiner has administrative credentials and the agent is running as a service. What is the most likely cause and solution?

   • AThe image storage location is full; free up space on the target server.
   • BThe agent is using an outdated protocol; update the agent to the latest version.
   • CThe network firewall is blocking the agent's port; open the port in the firewall.
   • DThe agent service is not running with sufficient privileges; reconfigure the service to run as LocalSystem.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A remote acquisition is failing because the target system's firewall is blocking the imaging tool's connection. The examiner has administrative credentials and can access the system via a remote management console. The imaging tool uses a proprietary protocol on port 9999. Which action is most appropriate?

   • ATemporarily create a firewall rule on the target system to allow port 9999, and remove it after the acquisition.
   • BDisable the firewall entirely for the duration of the acquisition.
   • CAsk the network team to block the port at the perimeter firewall.
   • DUse a different imaging tool that uses a port that is already allowed.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During a remote acquisition, the imaging tool reports that the hash of the received image does not match the hash computed at the source. The examiner suspects network corruption. Which step should be taken FIRST?

   • ARecompute the hash on the source system to see if it changes.
   • BIgnore the mismatch and proceed with analysis.
   • CRetransmit the image using a protocol that includes error checking, such as SCP or SFTP.
   • DCheck the network cable for physical damage.
   Reveal Solution Discussion Select an answer first