A forensic examiner is documenting a triage of a Windows system. The examiner used a triage tool to collect volatile data and then imaged the disk. Which documentation is necessary to show the sequence of actions taken during the triage?

A list of the suspect's favorite websites.

The name of the suspect's internet service provider.

A chronological log of commands and tool outputs.

The color of the suspect's desktop wallpaper.

A responder has only 10 minutes to triage a suspect workstation before it must be returned to service. The workstation is running and the user is logged in. Which data should the responder prioritize to maximize evidentiary value within the time limit?

A full disk image using a hardware write blocker.

Memory dump, active network connections, and a list of running processes.

The contents of the user's Recycle Bin and browser history.

All files in the user's Downloads folder and recent documents.

During triage of a Windows system, an investigator runs the command `ipconfig /all` and saves the output. What type of data is being collected?

Memory-resident malware signatures

Persistent file system metadata

Volatile network configuration data

A responder is triaging a system that is suspected of being used to exfiltrate data over the network. The responder has already captured memory and network connections. Which additional data should be prioritized next?

A list of running processes and their command-line arguments.

The system's uptime and last boot time.

The list of installed fonts and drivers.

The contents of the system's Recycle Bin.

A responder is triaging a database server that is actively being used by a business. The server is running and the responder has only 15 minutes before the server must be returned to full operation. The responder must collect evidence of a suspected SQL injection attack. Which data collection plan is most appropriate?

Copy the entire database directory to an external drive, then run a network capture for the remaining time.

Capture memory, then collect active network connections and the process list, and finally copy the database transaction logs from the disk.

Immediately shut down the server and image the entire disk to preserve all evidence.

Run a SQL query to extract all rows from the suspect table, then save the output to a file.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 3

Using Forensic Tools for Triage GBFA Practice Questions (Page 1)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 1–5

1application · medium
A forensic examiner is documenting a triage of a Windows system. The examiner used a triage tool to collect volatile data and then imaged the disk. Which documentation is necessary to show the sequence of actions taken during the triage?
Select an answer first
2application · medium
A responder has only 10 minutes to triage a suspect workstation before it must be returned to service. The workstation is running and the user is logged in. Which data should the responder prioritize to maximize evidentiary value within the time limit?
Select an answer first
3foundation · easy
During triage of a Windows system, an investigator runs the command `ipconfig /all` and saves the output. What type of data is being collected?
Select an answer first
4application · medium
A responder is triaging a system that is suspected of being used to exfiltrate data over the network. The responder has already captured memory and network connections. Which additional data should be prioritized next?
Select an answer first
5expert · hard
A responder is triaging a database server that is actively being used by a business. The server is running and the responder has only 15 minutes before the server must be returned to full operation. The responder must collect evidence of a suspected SQL injection attack. Which data collection plan is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.