A company wants to ensure that its incident response team can quickly and legally collect evidence from employee workstations. The legal department is concerned about employee privacy. Which policy should the company implement to support forensic readiness?

Allow employees to use personal devices for work without any monitoring.

Require employees to sign a waiver of all privacy rights as a condition of employment.

Establish a clear acceptable-use policy that informs employees that their devices may be monitored and searched.

Keep the monitoring policy secret to avoid alerting employees.

An examiner is called to a scene where a computer is running and the screen shows an open chat window. The examiner needs to preserve the evidence in a way that will be admissible in court. Which action should the examiner take FIRST?

Start the forensic imaging process immediately.

Close the chat window to prevent the other party from sending more messages.

Pull the network cable to stop communication.

Photograph the screen and document the visible chat content.

An examiner is investigating a case of unauthorized data access. The examiner has identified a suspect file on a network share. What is the next step in the forensic process?

Delete the file to prevent further unauthorized access.

Document the file's location and move it to a secure location.

Preserve the file by making a forensic copy and calculating a hash.

Analyze the file's metadata to determine who accessed it.

What is the primary purpose of maintaining a chain of custody for digital evidence?

To allow multiple investigators to access the evidence simultaneously.

To document every person who handled the evidence and show that it was not altered.

To prove that the evidence was stored on a secure server.

To ensure that the evidence is encrypted during transport.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 2)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 6–10

6application · medium
A company wants to ensure that its incident response team can quickly and legally collect evidence from employee workstations. The legal department is concerned about employee privacy. Which policy should the company implement to support forensic readiness?
Select an answer first
7application · medium
An examiner is called to a scene where a computer is running and the screen shows an open chat window. The examiner needs to preserve the evidence in a way that will be admissible in court. Which action should the examiner take FIRST?
Select an answer first
8application · medium
An examiner is investigating a case of unauthorized data access. The examiner has identified a suspect file on a network share. What is the next step in the forensic process?
Select an answer first
9foundation · easy
In the digital forensic process, which phase involves identifying potential sources of evidence and determining their relevance to the investigation?
Select an answer first
10foundation · easy
What is the primary purpose of maintaining a chain of custody for digital evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.