A forensic examiner is called to a scene where a suspect's smartwatch is on the wrist, and the paired phone is in the suspect's pocket. The watch has a proprietary charging/data cable, but the examiner does not have the cable. The watch is actively syncing with the phone. The examiner must preserve data while awaiting a warrant for the phone. What is the most appropriate immediate action?

Remove the watch from the suspect's wrist and power it off.

Ask the suspect to unlock the watch to stop the sync.

Place the suspect's hands in Faraday gloves to isolate the watch from the phone, then document the scene.

Wait for the warrant to seize the phone, then use the phone to back up the watch data.

During an investigation, a forensic examiner finds an IoT device that uses a proprietary communication protocol. The device is still powered on and connected to a local network. The examiner wants to preserve volatile data. What is the most appropriate immediate step?

Immediately pull the power cord to ensure the device is off.

Leave the device running and monitor network traffic for several hours.

Photograph the device's status indicators and network connections, then disconnect it from the network.

Connect a laptop to the device's debug port to capture live data.

A smart lock is seized from a crime scene. It has a Bluetooth interface and a small flash memory. The investigator needs to determine if the lock has any data that could be relevant. What is the BEST initial step?

Identify the device model and research its data storage and interfaces.

Perform a chip-off to read the flash memory.

Immediately attempt a Bluetooth connection to extract data.

Place the device in a Faraday bag to prevent remote access.

A forensic team is at a crime scene and finds a drone that is still powered on and connected to a smartphone via Wi-Fi. The drone is recording video. What is the BEST immediate action?

Use the smartphone to send a command to the drone to land.

Immediately grab the drone and disconnect the battery.

Document the drone's state, then disconnect the Wi-Fi connection and power down the drone.

Leave the drone powered on and connected to continue recording.

A forensic team seizes a drone that was flying over a restricted area. The drone's memory card is encrypted. The team also finds the drone's remote controller. What is the best practice for preserving the drone's data?

Remove the memory card and store it in a metal tin without documentation.

Power on the drone to check if it still has flight logs.

Keep the drone and controller together to preserve pairing information.

Place the drone and remote controller in separate Faraday bags and document the chain of custody.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 3

Specialty Device Fundamentals GBFA Practice Questions (Page 2)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 6–10

6expert · hard
A forensic examiner is called to a scene where a suspect's smartwatch is on the wrist, and the paired phone is in the suspect's pocket. The watch has a proprietary charging/data cable, but the examiner does not have the cable. The watch is actively syncing with the phone. The examiner must preserve data while awaiting a warrant for the phone. What is the most appropriate immediate action?
Select an answer first
7application · medium
During an investigation, a forensic examiner finds an IoT device that uses a proprietary communication protocol. The device is still powered on and connected to a local network. The examiner wants to preserve volatile data. What is the most appropriate immediate step?
Select an answer first
8application · medium
A smart lock is seized from a crime scene. It has a Bluetooth interface and a small flash memory. The investigator needs to determine if the lock has any data that could be relevant. What is the BEST initial step?
Select an answer first
9expert · hard
A forensic team is at a crime scene and finds a drone that is still powered on and connected to a smartphone via Wi-Fi. The drone is recording video. What is the BEST immediate action?
Select an answer first
10application · medium
A forensic team seizes a drone that was flying over a restricted area. The drone's memory card is encrypted. The team also finds the drone's remote controller. What is the best practice for preserving the drone's data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.