GIAC GBFA Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Battlefield Forensics and Acquisition (GBFA) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GBFA certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GBFA Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Battlefield Forensics and Acquisition (GBFA) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Battlefield Forensics and Acquisition exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GBFA Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GBFA Sample Questions:
01. After a traffic stop, a state police lab removes the microSD card from a seized Android phone and images it behind a write-blocked card reader. The image shows no recognizable filesystem, and its data partition looks like random data. Photographs taken at seizure show the phone's storage settings listing the card as part of internal storage.
What explains the image?
a) The card is formatted exFAT, which the imaging tool cannot parse into files
b) The phone adopted it, encrypting it with a key of its own
c) The card is failing and is returning unreadable data in place of its sectors
d) The write blocker scrambled the data as it passed from the card to the workstation
02. On a call from a manufacturing plant, an examiner hears that two member disks of the plant's storage array have failed and must judge, before traveling, whether the volume can still be rebuilt.
Which two configurations are designed to survive the loss of any two member disks?
(Choose two.)
a) A Storage Spaces simple space striped across the pool's drives
b) A RAID 6 array with dual distributed parity blocks
c) A RAID 5 array with distributed parity
d) A Storage Spaces three-way mirror
e) A Storage Spaces two-way mirror
03. In an insurance fraud unit, an examiner collects an unlocked iPhone by making a local backup on a forensic workstation that has never been connected to it. The backup comes out password-protected, and the user's backup password is unknown.
Why is the backup encrypted, and what does reading it require?
a) iCloud Backup forces local encryption, so the iCloud password opens it
b) Encryption is set on the iPhone itself, so the user's backup password is needed
c) The backup is encrypted with the device passcode, so the passcode already obtained opens it
d) Local backups are encrypted by default, so a fresh password can be set at the workstation
04. At a forward operating base, a collection team acting under its collection authority searches a seized notebook and finds a 24-character string of letters and numbers labeled "Mac recovery". The team also holds a powered-off Mac protected by FileVault.
Which two uses of this string fit?
(Choose two.)
a) Entering it in macOS Recovery when prompted, to unlock the data volume
b) Unlocking a BitLocker volume from its recovery screen
c) Turning off Activation Lock for the Mac's account
d) Entering it at the FileVault login window
e) Clearing the Mac's firmware password, so that it can start from external media
05. In a county sheriff's digital unit, a seized Android phone that uses file-based encryption was restarted during transport and has not been unlocked since it booted. An extraction is attempted without the user's PIN.
Which data can the extraction expect to reach?
a) Everything except photos and media, the only encrypted folders
b) All user data, since the file keys are released at boot
c) Only data apps keep in device-encrypted storage, not the credential-encrypted default
d) Nothing, because the whole data partition is one volume locked until the PIN is entered
06. Triage of a suspect's phone in a port theft inquiry finds a calendar event reading "Dock 4, 21:00" on the night of the theft. The event sits in a calendar synced from the suspect's work account; its organizer field names a colleague, and the suspect is listed as an invitee.
Which conclusion does this entry best support?
a) The suspect was at Dock 4 at 21:00 that night
b) The suspect created the event on this phone, since it is stored in the phone's calendar database
c) The colleague sent it to the suspect's account, and it reached the phone by sync
d) None, as data that arrived by sync shows nothing about this phone
07. Images of all four members of a home-office NAS that ran Linux md RAID 5 sit on the examiner's workstation, and nobody kept a record of how the array was set up.
Which structure on each member image records the array's RAID level and the identity of the array the member belongs to, so md tools can assemble the volume?
a) The partition table at the start of each member disk
b) The configuration held in a RAID controller's NVRAM
c) The ext4 superblock that describes the file system on the NAS data volume
d) The md superblock that stores the array's metadata on each member
08. During a search of a home office, a responder finds a running, logged-in Mac and opens About This Mac to document it before choosing an acquisition method.
Which line in About This Mac shows that the Mac has Apple silicon?
a) An item labeled Chip, followed by the name of the chip
b) The macOS version line
c) The Serial Number line
d) An item labeled Processor, with its name
09. An examiner at a small accounting firm has imaged one disk from the firm's Windows server. Disk Management had shown the disk as Dynamic and its data volume as Spanned, and the server's other disks are still in a store room.
Which structure on the imaged disk can tell the examiner which other disks hold the rest of that volume?
a) The drive serial number in the disk's ATA identify data
b) The NTFS boot sector of the data volume, which records the volume's size and layout
c) The MBR partition table of this dynamic disk, which lists its partitions
d) The replica of the dynamic disk database, which records the volumes and the other dynamic disks
10. During triage of an iPhone file-system extraction for a hit-and-run inquiry, an officer needs both the SMS and the iMessage conversations. Which database holds them?
a) AddressBook.sqlitedb
b) sms.db
c) CallHistory.storedata
d) Calendar.sqlitedb
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: b, d |
Question: 03 Answer: b |
Question: 04 Answer: a, d |
Question: 05 Answer: c |
|
Question: 06 Answer: c |
Question: 07 Answer: d |
Question: 08 Answer: a |
Question: 09 Answer: d |
Question: 10 Answer: b |
Note: For any error in GIAC Battlefield Forensics and Acquisition (GBFA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
