An incident responder is triaging a live Windows server that is part of a critical infrastructure environment. The responder must collect volatile data but cannot stop the server or take it offline. Which action is most appropriate?

Run a full antivirus scan and then reboot the server to clear any malware.

Copy the entire hard drive to a network share using a built-in backup tool.

Use PowerShell to export all event logs to a file, then shut down the server gracefully.

Run a memory acquisition tool from a trusted USB drive, then use built-in commands to capture network connections and process lists, saving output to the USB drive.

A field investigator arrives at a small office where a suspected data exfiltration occurred. The suspect workstation is powered on and the user is still logged in. The investigator has a USB forensic triage kit with limited storage and about 20 minutes before the office network must be restored. Which approach best balances speed, evidentiary value, and documentation?

Immediately pull the power cord to preserve the disk, then image the hard drive with a write blocker before doing anything else.

Run a full disk imaging tool first because the disk is the most reliable evidence, then capture memory afterward if time permits.

Use the built-in Windows Event Viewer to export all logs to the USB drive, then shut down the system normally.

Capture a memory image first, then collect the most volatile system state (network connections, logged-in users, running processes) and record the tool output with timestamps.

A triage team is collecting evidence from a suspect's laptop. They use a commercial triage tool to capture volatile data, then create a forensic image. The team leader needs to ensure the evidence is admissible in court. Which documentation step is most critical during the triage?

Record the exact time, tool version, and hash values of all collected data.

Take photographs of the suspect's desk and personal items.

Write a summary of the investigation's findings and conclusions.

Email the collected data to the legal team for review.

A responder is triaging a Linux server and needs to collect the list of currently established network connections and the processes associated with them. Which command or tool is most appropriate?

Use the 'netstat -r' command to display the routing table.

Use the 'ifconfig' command to show network interfaces and IP addresses.

Use the 'ss' command to list socket statistics, and 'ps' to list processes, then cross-reference the PIDs.

Use the 'top' command to display running processes, but it does not show network connections.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 3

Using Forensic Tools for Triage GBFA Practice Questions (Page 2)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 6–10

6application · medium
An incident responder is triaging a live Windows server that is part of a critical infrastructure environment. The responder must collect volatile data but cannot stop the server or take it offline. Which action is most appropriate?
Select an answer first
7application · medium
A field investigator arrives at a small office where a suspected data exfiltration occurred. The suspect workstation is powered on and the user is still logged in. The investigator has a USB forensic triage kit with limited storage and about 20 minutes before the office network must be restored. Which approach best balances speed, evidentiary value, and documentation?
Select an answer first
8foundation · easy
An investigator is performing triage on a Linux server and needs to collect a memory image for later analysis. Which tool is specifically designed for this purpose?
Select an answer first
9application · medium
A triage team is collecting evidence from a suspect's laptop. They use a commercial triage tool to capture volatile data, then create a forensic image. The team leader needs to ensure the evidence is admissible in court. Which documentation step is most critical during the triage?
Select an answer first
10application · medium
A responder is triaging a Linux server and needs to collect the list of currently established network connections and the processes associated with them. Which command or tool is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Using Forensic Tools for Triage GBFA Practice Questions (Page 2)

Questions 6–10

An incident responder is triaging a live Windows server that is part of a critical infrastructure environment. The responder must collect volatile data but cannot stop the server or take it offline. Which action is most appropriate?

An investigator is performing triage on a Linux server and needs to collect a memory image for later analysis. Which tool is specifically designed for this purpose?

A triage team is collecting evidence from a suspect's laptop. They use a commercial triage tool to capture volatile data, then create a forensic image. The team leader needs to ensure the evidence is admissible in court. Which documentation step is most critical during the triage?

A responder is triaging a Linux server and needs to collect the list of currently established network connections and the processes associated with them. Which command or tool is most appropriate?

Keep studying — Triage and Manual Analysis