During an incident, a forensic investigator needs to capture the contents of RAM from a compromised Windows workstation. The workstation is currently running and the investigator wants to preserve the most volatile data first. Which action should the investigator take?

Create a forensic image of the hard drive first, then acquire memory.

Power off the workstation and remove the RAM modules for physical analysis.

Copy the pagefile.sys file to an external drive for later analysis.

Run a memory acquisition tool to dump RAM to an external forensic drive, then record the SHA-256 hash.

A Windows server was compromised and the incident response team needs to preserve the disk for forensic analysis. The server is still running and the business cannot afford downtime. The team has a forensic write-blocker and a spare drive. Which action best preserves the evidence while minimizing disruption?

Perform a live acquisition of the running system using a forensic tool, then verify the image hash.

Power down the server gracefully, remove the disk, and create a bit-for-bit image using a write-blocker.

Copy the entire disk to the spare drive using the operating system's built-in copy command, then label the copy.

Take a memory dump first, then perform a static acquisition of the disk after a hard power-off.

An examiner is analyzing a forensic image and finds a file that was deleted, but the file's data clusters are still marked as allocated in the file system. What does this indicate?

The file was securely deleted using a wiping tool.

The file system is corrupted and the image is unusable.

The file is encrypted and cannot be recovered.

The file was deleted but its data has not yet been overwritten, and the file system metadata still references it.

During a forensic examination, an analyst finds a partition on the suspect's drive that appears to be unallocated space, but the partition table shows a smaller partition than the physical drive size. The analyst suspects data hiding. Which technique is the suspect MOST likely using?

Deleting files and wiping the free space with a secure deletion tool.

Using steganography to hide data inside image files.

Creating a hidden partition by manipulating the partition table.

Encrypting the entire drive with BitLocker.

A forensic examiner is preparing a report for a case that will be used in a civil lawsuit. The report must be clear to a judge who has limited technical knowledge. Which approach is BEST for presenting the findings?

Provide a summary of findings in plain language, with technical details in appendices.

Include only the raw data and let the reader draw conclusions.

Use highly technical language throughout to demonstrate expertise.

Write the report as a narrative of the investigation without separating facts from opinions.

GIAC Certified Enterprise Defender

Domain 2Objective 2

Digital Forensics Concepts and Application GCED Practice Questions (Page 6)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 26–30

26application · medium
During an incident, a forensic investigator needs to capture the contents of RAM from a compromised Windows workstation. The workstation is currently running and the investigator wants to preserve the most volatile data first. Which action should the investigator take?
Select an answer first
27application · medium
A Windows server was compromised and the incident response team needs to preserve the disk for forensic analysis. The server is still running and the business cannot afford downtime. The team has a forensic write-blocker and a spare drive. Which action best preserves the evidence while minimizing disruption?
Select an answer first
28application · medium
An examiner is analyzing a forensic image and finds a file that was deleted, but the file's data clusters are still marked as allocated in the file system. What does this indicate?
Select an answer first
29application · medium
During a forensic examination, an analyst finds a partition on the suspect's drive that appears to be unallocated space, but the partition table shows a smaller partition than the physical drive size. The analyst suspects data hiding. Which technique is the suspect MOST likely using?
Select an answer first
30application · medium
A forensic examiner is preparing a report for a case that will be used in a civil lawsuit. The report must be clear to a judge who has limited technical knowledge. Which approach is BEST for presenting the findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.