A forensic examiner is documenting a triage session. The examiner used a custom script to collect process and network data from a suspect machine. What is the most important documentation step to ensure the admissibility of the collected data?

Write a summary of the findings in the final report, noting that the data was collected during triage.

Take a photograph of the screen showing the tool output, and include it in the report.

Store the collected data in the case management system without additional notes, since the tool output is self-explanatory.

Record the exact command line, tool version, and the time each command was executed, and save the raw output to a write-protected medium.

A forensic examiner is documenting a triage of a Windows system that is part of a multi-jurisdictional investigation. The examiner used a triage tool to collect volatile data and then imaged the disk. The evidence will be shared with law enforcement in another country. Which documentation is essential to ensure the evidence is accepted across jurisdictions?

Documentation that follows a recognized standard, such as ISO 27037 or NIST guidelines.

Documentation that only lists the tools used, without details of the process.

Documentation written in the examiner's native language only.

Documentation that includes the examiner's personal opinions about the case.

During a triage of a compromised database server, the investigator must decide what to collect. The server is running, and the attacker may have deleted logs. Which data should be prioritized for collection?

The database files and configuration files.

The operating system's event logs.

Memory dump and active network connections.

A full disk image of the server.

A forensic examiner is triaging a live Linux server that is suspected of being used as a command-and-control node. The server is remote and the examiner has SSH access. The examiner must collect volatile data without alerting the attacker, who may be monitoring the system. Which approach is most appropriate?

Run a full disk image over the network using dd, then analyze it offline.

Install a forensic toolkit via the package manager to ensure all tools are available and up to date.

Use a trusted static binary for memory acquisition and run built-in commands (e.g., ss, ps) to capture network and process state, saving output to an external location.

Reboot the server into a forensic live CD to ensure a clean environment for data collection.

A forensic examiner is documenting a triage session. The examiner used a triage tool to collect volatile data and then imaged the hard drive. Which documentation element is essential for maintaining chain of custody?

A log of who handled the evidence and when.

The serial number of the suspect's keyboard.

A list of the software installed on the forensic workstation.

The examiner's personal notes about the suspect's guilt.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 3

Using Forensic Tools for Triage GBFA Practice Questions (Page 3)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 11–15

11application · medium
A forensic examiner is documenting a triage session. The examiner used a custom script to collect process and network data from a suspect machine. What is the most important documentation step to ensure the admissibility of the collected data?
Select an answer first
12expert · hard
A forensic examiner is documenting a triage of a Windows system that is part of a multi-jurisdictional investigation. The examiner used a triage tool to collect volatile data and then imaged the disk. The evidence will be shared with law enforcement in another country. Which documentation is essential to ensure the evidence is accepted across jurisdictions?
Select an answer first
13application · medium
During a triage of a compromised database server, the investigator must decide what to collect. The server is running, and the attacker may have deleted logs. Which data should be prioritized for collection?
Select an answer first
14expert · hard
A forensic examiner is triaging a live Linux server that is suspected of being used as a command-and-control node. The server is remote and the examiner has SSH access. The examiner must collect volatile data without alerting the attacker, who may be monitoring the system. Which approach is most appropriate?
Select an answer first
15application · medium
A forensic examiner is documenting a triage session. The examiner used a triage tool to collect volatile data and then imaged the hard drive. Which documentation element is essential for maintaining chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Using Forensic Tools for Triage GBFA Practice Questions (Page 3)

Questions 11–15

A forensic examiner is documenting a triage session. The examiner used a custom script to collect process and network data from a suspect machine. What is the most important documentation step to ensure the admissibility of the collected data?

During a triage of a compromised database server, the investigator must decide what to collect. The server is running, and the attacker may have deleted logs. Which data should be prioritized for collection?

A forensic examiner is documenting a triage session. The examiner used a triage tool to collect volatile data and then imaged the hard drive. Which documentation element is essential for maintaining chain of custody?

Keep studying — Triage and Manual Analysis