Using Forensic Tools for Triage GBFA Practice Questions (Page 9)

Questions 41–45

1. 41application · easy

   During a triage of a compromised server, the responder has limited time and must choose what to collect first. The server is running and network connections are active. Which data collection order is most aligned with the order of volatility?

   • ANetwork connections, memory contents, running processes, then disk image.
   • BMemory contents, network connections, running processes, then disk image.
   • CRunning processes, network connections, memory contents, then disk image.
   • DDisk image, memory contents, network connections, then running processes.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An investigator is triaging a compromised Linux server that is also a production web server. The server is running, but the attacker may have a backdoor. The investigator has a triage tool that can collect the process list, network connections, and loaded kernel modules. The investigator must minimize downtime while collecting the most valuable evidence. What is the best approach?

   • ATake the server offline immediately to prevent further compromise.
   • BCollect the process list and network connections first, then loaded kernel modules.
   • CCollect only the process list and skip the rest.
   • DCollect loaded kernel modules first, then processes and network connections.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An investigator is triaging a laptop that was used to send a threatening email. The laptop is running, and the investigator has a triage tool that can collect the email client's cache, recent documents, and the system's pagefile. What should be prioritized for collection?

   • AThe external monitor's serial number.
   • BEmail client cache and recent documents.
   • CThe system's pagefile.
   • DThe laptop's BIOS settings.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A responder is triaging a laptop that was used to access a cloud-based email account. The laptop is running and the user is logged in. The responder has limited time and must decide what to collect. Which data has the highest evidentiary value for this specific investigation?

   • AMemory contents, which may contain email content, credentials, and active session tokens.
   • BThe list of installed applications, to determine if any email client is installed.
   • CThe browser cache and history files from the disk.
   • DThe system event logs, which record all user actions.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   During a triage of a compromised Linux server, the investigator must choose the order of data collection. The server is running, but the attacker may have remote access. Which collection order best follows volatility prioritization?

   • AMemory dump, running processes, network connections, then disk image.
   • BDisk image, memory dump, network connections, then running processes.
   • CRunning processes, disk image, memory dump, then network connections.
   • DNetwork connections, running processes, disk image, then memory dump.
   Reveal Solution Discussion Select an answer first