A forensic examiner needs to create a forensic image of a Windows system's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not modified. Which tool and method should be used?

Use a hardware write blocker and FTK Imager to create a raw image, then verify the image's hash matches the original drive's hash.

Use the 'dd' command in a Linux live environment without a write blocker.

Copy all files from the drive to a network share using Windows Explorer.

Use Windows Backup to create a system image to an external USB drive.

During an incident response, you must create a forensic image of a Windows laptop's hard drive. The laptop is running and the user cannot shut it down. Which acquisition method best preserves evidentiary integrity?

Boot the laptop from a trusted forensic USB drive and acquire the disk to an external drive, then hash both the source and image.

Copy all user files to an external drive and compute a hash of the copied files.

Use the built-in Windows Backup to create a system image and store it on a USB drive.

Run FTK Imager on the live system and acquire the disk to a network share.

In NTFS, what is the Master File Table (MFT) primarily used for?

Storing metadata about every file and directory on the volume

Storing the contents of all files on the volume

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 9)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 41–45

41foundation · easy
Which Windows audit policy category would you enable to track successful and failed attempts to log on to a Windows system?
Select an answer first
42foundation · easy
Which tool or feature in Windows allows you to create custom queries to filter event logs based on specific criteria such as event ID or source?
Select an answer first
43application · medium
A forensic examiner needs to create a forensic image of a Windows system's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not modified. Which tool and method should be used?
Select an answer first
44application · medium
During an incident response, you must create a forensic image of a Windows laptop's hard drive. The laptop is running and the user cannot shut it down. Which acquisition method best preserves evidentiary integrity?
Select an answer first
45foundation · easy
In NTFS, what is the Master File Table (MFT) primarily used for?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 9)

Questions 41–45

Which Windows audit policy category would you enable to track successful and failed attempts to log on to a Windows system?

Which tool or feature in Windows allows you to create custom queries to filter event logs based on specific criteria such as event ID or source?

A forensic examiner needs to create a forensic image of a Windows system's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not modified. Which tool and method should be used?

During an incident response, you must create a forensic image of a Windows laptop's hard drive. The laptop is running and the user cannot shut it down. Which acquisition method best preserves evidentiary integrity?

In NTFS, what is the Master File Table (MFT) primarily used for?

Keep studying — Endpoint and Platform Security