Using Forensic Tools for Triage GBFA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A corporate incident response team needs to triage a macOS system that may be involved in intellectual property theft. The team has a limited budget and needs to collect volatile data and document the process. Which tool selection is most appropriate?

   • AUse a manual command-line approach without any tool.
   • BSkip triage and send the system to a remote lab for analysis.
   • CUse an open-source triage tool that supports macOS and generates a report.
   • DUse a Windows-only triage tool because it is familiar to the team.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A field investigator arrives at a small office with a suspected data-exfiltration incident. The suspect's Windows 10 workstation is powered on and logged in, but the user is not present. The investigator has a write-blocker, a USB forensic toolkit, and a portable triage tool that can capture running processes, network connections, and recent files. The office has no network connectivity for the forensic laptop. What should the investigator do first?

   • ACreate a forensic image of the hard drive using the write-blocker before touching any live data.
   • BPower down the workstation immediately to preserve the hard drive from further writes.
   • CDisconnect the workstation from the network and then wait for a senior investigator to arrive.
   • DRun the portable triage tool to capture volatile data to the USB forensic drive.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An incident response team is preparing a triage kit for a corporate environment that includes both Windows 10 and Linux servers. The team has a limited budget and must choose tools that can be used by junior analysts. The team also needs to collect memory, network connections, and running processes, and must document the process for potential legal action. Which tool selection strategy best meets these competing requirements?

   • AUse a collection of open-source command-line tools that are free, but require the analyst to manually record outputs and hashes.
   • BUse a commercial triage suite that supports both Windows and Linux, has a GUI with guided workflows, and automatically generates a report with hashes and timestamps.
   • CUse a memory acquisition tool that only works on Windows, and use a separate Linux script for the Linux systems.
   • DUse a hardware write blocker and a disk-imaging tool, and rely on the disk image for all evidence.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic examiner is using a triage tool that automatically logs all actions and generates a report. The examiner also manually records notes about the scene. What is the most important reason to keep the manual notes?

   • ATo provide a backup in case the tool-generated report is lost.
   • BTo replace the tool-generated report, since manual notes are more reliable.
   • CTo capture observations that the tool cannot record, such as the physical state of the system, user behavior, and environmental conditions.
   • DTo satisfy the requirement that all evidence be handwritten.
   Reveal Solution Discussion Select an answer first
6. 35application · easy

   A forensic examiner used a triage tool to collect data from a suspect machine. The examiner later needs to prove that the collected data has not been altered since acquisition. What is the most appropriate action to support this?

   • AStore the data on a USB drive and keep it in a locked drawer without any additional documentation.
   • BEmail the collected data to the investigating officer for safekeeping.
   • CTake a screenshot of the tool output and save it in the case file.
   • DGenerate a cryptographic hash of the collected data at the time of acquisition and record it in the chain-of-custody documentation.
   Reveal Solution Discussion Select an answer first