A small business has a single server that was compromised. The incident response team needs to preserve evidence for potential legal action. The server is running and connected to the network. Which step should be taken FIRST to preserve digital evidence?

Document the system time and date, then shut down the server gracefully.

Create a forensic image of the hard drive using a write blocker.

Immediately pull the network cable and power off the server to prevent further damage.

Perform a live acquisition of the server's memory and capture the current network connections.

A company wants to improve its forensic readiness. They are concerned about the cost of storing full disk images for all employees. Which approach best balances forensic readiness with cost and storage constraints?

Outsource all forensic readiness to a third-party vendor that will handle all evidence collection and storage.

Implement a policy to capture and store full disk images of all endpoints on a nightly basis.

Focus on logging and monitoring key systems, and retain logs for a defined period, while documenting the process for on-demand acquisition.

Purchase forensic imaging software and train all IT staff on its use, but do not store any images proactively.

Which element is essential in forensic documentation to ensure that another examiner could replicate the analysis?

A summary of the case facts as reported by the media.

The contact information of the investigating officer.

A list of all the examiner's personal opinions about the case.

A detailed description of the steps taken, including tools, versions, and parameters used.

An examiner is asked to investigate a manager's computer for suspected fraud. The company has a policy that allows monitoring of company devices. The examiner finds evidence of personal banking activity that is unrelated to the fraud. What is the most appropriate action?

Include the personal banking details in the report because they are on a company device.

Ignore the personal data and do not mention it in any documentation.

Delete the personal banking files to protect the manager's privacy.

Note the existence of the personal data in the report but do not include the details.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 6)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 26–30

26application · medium
A small business has a single server that was compromised. The incident response team needs to preserve evidence for potential legal action. The server is running and connected to the network. Which step should be taken FIRST to preserve digital evidence?
Select an answer first
27foundation · easy
Which forensic process phase ensures that evidence remains unchanged from the moment it is collected until it is presented in court?
Select an answer first
28application · medium
A company wants to improve its forensic readiness. They are concerned about the cost of storing full disk images for all employees. Which approach best balances forensic readiness with cost and storage constraints?
Select an answer first
29foundation · easy
Which element is essential in forensic documentation to ensure that another examiner could replicate the analysis?
Select an answer first
30application · medium
An examiner is asked to investigate a manager's computer for suspected fraud. The company has a policy that allows monitoring of company devices. The examiner finds evidence of personal banking activity that is unrelated to the fraud. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.