A company is developing a forensic readiness plan. They want to ensure that when an incident occurs, they can quickly identify which systems were involved. What is the most effective proactive measure?

Store full disk images of all systems on a weekly basis.

Maintain an up-to-date inventory of all hardware and software assets, including network configurations.

Wait until an incident occurs and then ask employees which systems they used.

Disable all logging to reduce the amount of data that needs to be reviewed.

A company is designing its forensic readiness program. The legal team wants to ensure that evidence collected during an incident can be used in civil litigation. Which element is most important to include in the program?

A policy that allows employees to use personal devices for work.

A large budget for forensic tools.

Documented procedures for evidence collection and preservation.

A plan to immediately shut down systems during an incident.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 9)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 41–42

41application · medium
A company is developing a forensic readiness plan. They want to ensure that when an incident occurs, they can quickly identify which systems were involved. What is the most effective proactive measure?
Select an answer first
42application · medium
A company is designing its forensic readiness program. The legal team wants to ensure that evidence collected during an incident can be used in civil litigation. Which element is most important to include in the program?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Digital Forensic Fundamentals GCFE Practice Questions (Page 9)

Questions 41–42

A company is developing a forensic readiness plan. They want to ensure that when an incident occurs, they can quickly identify which systems were involved. What is the most effective proactive measure?

A company is designing its forensic readiness program. The legal team wants to ensure that evidence collected during an incident can be used in civil litigation. Which element is most important to include in the program?

Keep studying — Digital Forensic Fundamentals