A forensic examiner is investigating a case involving a smart home hub. The hub is connected to various IoT devices, including locks, cameras, and sensors. The examiner needs to determine what data is stored on the hub and what is stored in the cloud. What is the BEST approach?

Identify the hub's model and research its data storage architecture, then acquire both local and cloud data.

Only acquire local data from the hub's storage.

Perform a chip-off of the hub's flash memory to get all data.

Only acquire cloud data from the vendor's servers.

An investigator finds a smart bulb that is part of a home automation system. The bulb has a small flash memory and communicates via Zigbee. What is the MOST likely data that can be recovered from the bulb itself?

Configuration settings and usage logs.

Contact lists from the owner's phone.

Audio recordings from the room.

A forensic examiner is attempting to extract data from a wearable fitness tracker that uses a proprietary encrypted protocol. The tracker has a charging cable that also serves as a data cable. What is the most significant challenge to data extraction?

The tracker's battery is too low to power on.

The data is encrypted and requires proprietary decryption tools.

The tracker is not recognized by the computer.

The charging cable does not carry data.

A drone is recovered from a suspect. The drone has a proprietary flight controller and a microSD card. The investigator needs to recover flight logs and media. The drone's battery is nearly depleted. What is the MOST appropriate acquisition approach?

Remove the battery and store the drone without further action.

Power on the drone and connect to its Wi-Fi to download logs.

Image the microSD card using a write blocker, then attempt a logical acquisition of the flight controller via its proprietary interface.

Perform a chip-off of the flight controller's flash memory.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 3

Specialty Device Fundamentals GBFA Practice Questions (Page 5)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 21–25

21expert · hard
A forensic examiner is investigating a case involving a smart home hub. The hub is connected to various IoT devices, including locks, cameras, and sensors. The examiner needs to determine what data is stored on the hub and what is stored in the cloud. What is the BEST approach?
Select an answer first
22application · medium
During a search, an investigator finds a smart TV, a gaming console, and a voice assistant. Which device is most likely to store voice recordings that could be relevant?
Select an answer first
23application · medium
An investigator finds a smart bulb that is part of a home automation system. The bulb has a small flash memory and communicates via Zigbee. What is the MOST likely data that can be recovered from the bulb itself?
Select an answer first
24application · medium
A forensic examiner is attempting to extract data from a wearable fitness tracker that uses a proprietary encrypted protocol. The tracker has a charging cable that also serves as a data cable. What is the most significant challenge to data extraction?
Select an answer first
25application · medium
A drone is recovered from a suspect. The drone has a proprietary flight controller and a microSD card. The investigator needs to recover flight logs and media. The drone's battery is nearly depleted. What is the MOST appropriate acquisition approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.