During a forensic examination, an investigator finds that a suspect's hard drive contains a large amount of unallocated space with no readable deleted files. The investigator suspects anti-forensic techniques were used. Which technique is most likely being used to hide data in this scenario?

The suspect used file wiping tools to overwrite deleted file data.

The suspect encrypted the entire hard drive with BitLocker.

The suspect used steganography to embed data in image files.

The suspect hid files in the alternate data streams of NTFS.

Why is it important to document the tools and methods used in a forensic investigation?

To ensure that the tools are up to date.

To prove that the investigator is certified.

To speed up the investigation process.

To allow the investigation to be reproduced and validated by others.

During an incident, a security analyst suspects that a malicious process is running in memory but has not yet touched the disk. The affected workstation is still on. Which step should the analyst take FIRST to preserve the most volatile evidence?

Copy the executable file from the disk to an evidence drive.

Capture the contents of RAM using a memory acquisition tool.

Query the process list and save the output to a text file.

Run a network packet capture to see what the process is sending.

A forensic examiner is writing a report for a data breach investigation that will be reviewed by legal counsel and presented to senior management. Which characteristic is MOST important for the report to be legally defensible?

The report uses technical jargon to demonstrate the examiner's expertise.

The report clearly separates facts from opinions and describes the methods used.

The report includes only the final conclusions without supporting data.

The report is written in an informal, conversational tone to be more readable.

A forensic examiner is collecting evidence from a crime scene involving a company laptop. The examiner needs to ensure the evidence is admissible in court. Which action is most critical for maintaining a valid chain of custody?

Document every person who handled the evidence and every transfer with timestamps and signatures.

Place the laptop in an anti-static bag and seal it with evidence tape.

Create a forensic image of the laptop's hard drive immediately.

Take a photograph of the laptop at the scene before touching it.

GIAC Certified Enterprise Defender

Domain 2Objective 2

Digital Forensics Concepts and Application GCED Practice Questions (Page 4)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 16–20

16application · medium
During a forensic examination, an investigator finds that a suspect's hard drive contains a large amount of unallocated space with no readable deleted files. The investigator suspects anti-forensic techniques were used. Which technique is most likely being used to hide data in this scenario?
Select an answer first
17foundation · easy
Why is it important to document the tools and methods used in a forensic investigation?
Select an answer first
18application · medium
During an incident, a security analyst suspects that a malicious process is running in memory but has not yet touched the disk. The affected workstation is still on. Which step should the analyst take FIRST to preserve the most volatile evidence?
Select an answer first
19application · medium
A forensic examiner is writing a report for a data breach investigation that will be reviewed by legal counsel and presented to senior management. Which characteristic is MOST important for the report to be legally defensible?
Select an answer first
20application · medium
A forensic examiner is collecting evidence from a crime scene involving a company laptop. The examiner needs to ensure the evidence is admissible in court. Which action is most critical for maintaining a valid chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.