Using Forensic Tools for Triage GBFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A corporate incident response team needs to triage a fleet of 50 Windows workstations after a suspected ransomware outbreak. The team has a central management server and wants to collect volatile data from all machines quickly. Which tool selection is most appropriate?

   • AA remote triage tool that can be deployed from the central server to collect memory, network connections, and process lists from multiple machines simultaneously.
   • BA memory acquisition tool that only works on one machine at a time, requiring manual operation.
   • CA portable USB triage kit that must be physically connected to each workstation.
   • DA disk-imaging tool that images each workstation's hard drive over the network.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An investigator collects volatile data from a suspect system and stores the output on a USB drive. Which of the following actions is essential to maintain the chain of custody?

   • AEncrypt the USB drive with a password known only to the investigator
   • BRecord the date, time, and location of the collection
   • CMake a second copy of the data and store it in the investigator's personal locker
   • DDelete the original data from the suspect system after collection
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An investigator is triaging a Windows system that is part of a ransomware investigation. The system is running, and the investigator has a triage tool that can collect the registry, event logs, and recently accessed files. The tool also has a built-in write-blocker for the USB output. What is the most appropriate way to operate the tool?

   • ADisable the write-blocker to allow the tool to write logs to the system drive.
   • BRun the tool over the network from the investigator's laptop.
   • CRun the tool from a trusted USB drive and save output to the same drive.
   • DCopy the tool to the suspect's hard drive and run it from there.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An incident responder is triaging a Windows server that is both a domain controller and a file server. The server is running, but the attacker may have remote access. The responder has a triage tool that can collect the registry, event logs, and active network connections. The responder must balance the need to collect volatile data with the risk of alerting the attacker. What is the best approach?

   • ACollect event logs first, then network connections and the registry.
   • BDisconnect the server from the network before collecting anything.
   • CCollect active network connections first, then the registry and event logs.
   • DCollect the registry first, then network connections and event logs.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An investigator uses the command `memdump -p 1234` on a Windows system during triage. What is the primary purpose of this command?

   • AList all running processes on the system
   • BCapture the memory of the process with PID 1234
   • CTerminate the process with PID 1234
   • DCreate a full physical memory image of the system
   Reveal Solution Discussion Select an answer first