Which sequence correctly represents the standard forensic investigation process?

Identification, Preservation, Analysis, Reporting

Preservation, Identification, Analysis, Reporting

Reporting, Identification, Preservation, Analysis

Analysis, Identification, Preservation, Reporting

A company has experienced a data breach and the incident response team is starting the forensic investigation. The team must ensure that evidence is collected in a way that is legally defensible. Which sequence of steps best follows the forensic process?

Report findings first, then collect evidence to support the report.

Analyze the data first, then identify evidence sources, and finally preserve the evidence.

Identify potential evidence sources, preserve them, analyze the data, and document findings in a report.

Preserve all data, then identify the evidence sources, and analyze without documentation.

A network forensic investigator is analyzing a large packet capture from a breach. The investigator needs to identify which internal host first communicated with a known malicious domain. The capture spans multiple days and contains terabytes of data. Which approach is MOST efficient for this task?

Examine the firewall logs instead of the packet capture.

Manually inspect every packet in the capture to find the first communication.

Use a network forensic tool to index the capture and search for DNS queries to the malicious domain, then correlate with the source IP addresses.

Filter the capture for HTTP traffic to the malicious domain and ignore other protocols.

What is the primary goal of digital forensics during an incident response?

To recover deleted files from compromised systems.

To prevent future incidents by implementing new security controls.

To restore systems to their pre-incident state as quickly as possible.

To identify the root cause and extent of the incident while preserving evidence for potential legal action.

GIAC Certified Enterprise Defender

Domain 2Objective 2

Digital Forensics Concepts and Application GCED Practice Questions (Page 8)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 36–40

36foundation · easy
Which sequence correctly represents the standard forensic investigation process?
Select an answer first
37application · medium
A company has experienced a data breach and the incident response team is starting the forensic investigation. The team must ensure that evidence is collected in a way that is legally defensible. Which sequence of steps best follows the forensic process?
Select an answer first
38application · medium
A forensic analyst is investigating a suspected malware infection on a Windows machine. The analyst wants to identify running processes and active network connections at the time of the incident. Which source of evidence would provide this information?
Select an answer first
39expert · hard
A network forensic investigator is analyzing a large packet capture from a breach. The investigator needs to identify which internal host first communicated with a known malicious domain. The capture spans multiple days and contains terabytes of data. Which approach is MOST efficient for this task?
Select an answer first
40foundation · easy
What is the primary goal of digital forensics during an incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.