A forensic team is deploying to a remote site with limited power and no internet. They need to triage a mix of Windows and Linux machines. The team has a budget for one new tool. Which tool should they prioritize?

A portable forensic triage station that includes a write blocker, memory acquisition tools, and a small display for reviewing collected data.

A cloud-based triage service that requires an internet connection to upload and analyze data.

A high-end laptop with pre-installed forensic software, but no write blocker or memory acquisition tools.

A set of external hard drives for storing disk images, but no triage tools.

A digital forensics team is preparing to triage a Windows server that is part of a critical infrastructure environment. The server cannot be taken offline, and the team has a triage tool that can collect volatile data and create a memory dump. What is the most appropriate tool selection?

Use a tool that requires a reboot to collect data.

Use a tool that is not tested on the server's operating system version.

Use a triage tool that supports live memory acquisition and minimal system impact.

Use a tool that only collects non-volatile data.

A responder is triaging a Windows machine that is suspected of being used for unauthorized data access. The responder has a trusted USB toolkit and needs to collect the system time, logged-in users, and running processes. Which tool or command is most appropriate for collecting this data?

Use built-in Windows commands (e.g., date /t, whoami, tasklist) and save the output to the USB drive.

Use the Windows Event Viewer to export the security log, which contains all the needed information.

Use a third-party process viewer that must be installed on the system.

Use PowerShell to run a script that collects the data and emails it to the responder's account.

A triage team is responding to a suspected insider threat. The suspect's workstation is running, and the team has a triage tool that can capture the clipboard, open files, and running processes. Which data should be collected first?

The user's profile folder and documents.

Clipboard contents and running processes.

A full disk image of the workstation.

During triage, an investigator uses a tool to collect volatile data and then records the tool's name, version, and the exact commands used. What is the primary purpose of this documentation?

To ensure the investigation can be reproduced and validated

To make the report easier to read for non-technical stakeholders

To speed up the data collection process

To reduce the need for a chain of custody

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 3

Using Forensic Tools for Triage GBFA Practice Questions (Page 8)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 36–40

36expert · hard
A forensic team is deploying to a remote site with limited power and no internet. They need to triage a mix of Windows and Linux machines. The team has a budget for one new tool. Which tool should they prioritize?
Select an answer first
37application · medium
A digital forensics team is preparing to triage a Windows server that is part of a critical infrastructure environment. The server cannot be taken offline, and the team has a triage tool that can collect volatile data and create a memory dump. What is the most appropriate tool selection?
Select an answer first
38application · medium
A responder is triaging a Windows machine that is suspected of being used for unauthorized data access. The responder has a trusted USB toolkit and needs to collect the system time, logged-in users, and running processes. Which tool or command is most appropriate for collecting this data?
Select an answer first
39application · medium
A triage team is responding to a suspected insider threat. The suspect's workstation is running, and the team has a triage tool that can capture the clipboard, open files, and running processes. Which data should be collected first?
Select an answer first
40foundation · easy
During triage, an investigator uses a tool to collect volatile data and then records the tool's name, version, and the exact commands used. What is the primary purpose of this documentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.