During a search warrant execution, an investigator finds a smart home hub on the network. The device has a microSD card and a proprietary OS. The investigator needs to preserve the device and its data for later analysis. What is the BEST immediate action to maintain evidentiary integrity?

Unplug the device and place it in an anti-static bag without further documentation.

Photograph the device, note its state, and isolate it from the network without powering it down.

Power the device down and remove the microSD card for imaging.

Immediately connect the device to a forensic workstation to perform a logical acquisition.

A smart TV is seized in a child exploitation investigation. The TV has a USB port and the suspect may have used it to view media. The investigator wants to preserve the TV and any connected USB devices. What is the BEST approach?

Remove the USB devices and connect them to a forensic workstation immediately.

Leave the TV connected to the network to preserve cloud data.

Power on the TV to check for connected USB devices.

Document the TV's state, disconnect it from the network, and seize any USB devices separately.

A forensic examiner is trying to acquire data from a smart thermostat that uses a proprietary protocol and has encrypted storage. The device is not rooted and the vendor does not provide a forensic tool. What is the MOST likely challenge?

The device may not have any storage.

The device's encryption may prevent data extraction without the key.

The device may be too small to handle.

The device may require a cloud account to access any data.

When handling a specialty device at a crime scene, what is the primary reason to place it in a Faraday bag?

To prevent remote access, data alteration, or network communication.

To prevent the device from being identified by its serial number.

To keep the device charged for later analysis.

To protect the device from physical damage during transport.

Which storage characteristic is commonly associated with wearable fitness devices?

They store data only on a removable microSD card.

They typically have limited internal flash memory and sync data to a companion app or cloud service.

They use hot-swappable hard drives for user data.

They have no storage and only display real-time data.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 3

Specialty Device Fundamentals GBFA Practice Questions (Page 1)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 1–5

1application · medium
During a search warrant execution, an investigator finds a smart home hub on the network. The device has a microSD card and a proprietary OS. The investigator needs to preserve the device and its data for later analysis. What is the BEST immediate action to maintain evidentiary integrity?
Select an answer first
2expert · hard
A smart TV is seized in a child exploitation investigation. The TV has a USB port and the suspect may have used it to view media. The investigator wants to preserve the TV and any connected USB devices. What is the BEST approach?
Select an answer first
3expert · hard
A forensic examiner is trying to acquire data from a smart thermostat that uses a proprietary protocol and has encrypted storage. The device is not rooted and the vendor does not provide a forensic tool. What is the MOST likely challenge?
Select an answer first
4foundation · easy
When handling a specialty device at a crime scene, what is the primary reason to place it in a Faraday bag?
Select an answer first
5foundation · easy
Which storage characteristic is commonly associated with wearable fitness devices?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.