Free Practice Questions for GIAC GASF Exam

Question 1

Using an emulator and running an application through a series of processes to figure out how it would behave on an actual device is called:

AForensic analysis

BDynamic analysis

CWeb analysis

DStatic analysis

Correct Answer: B. Dynamic analysis

Question 2

Cellebrite's Physical Analyzer will conduct a Quick Scan for images, which goes through and carves files that may have been deleted from the device. When carving for image files, which of the following methods is most effectively used to recover data?

AUpdate the signature database

BCarve based on file header

CCarve based on file metadata

DCarve based on memory ranges

Correct Answer: B. Carve based on file header

Question 3

What type of acquisition has occurred for this device?

APhysical

BFile system

CBypass lock

DLogical

Correct Answer: B. File system

Question 4

What are the three components that make up the International Mobile Subscriber Identity (IMSI)?

AMobile Station International Subscriber Directory Number (MSISDN), Mobile Network Code (MNC), Mobile
Station Identification Number (MSIN)

BSubscriber Identity Module (SIM), Mobile Station International Subscriber Directory Number (MSISDN),
Mobile Network Code (MNC)

CMobile Country Code (MCC), Mobile Network Code (MNC), Mobile Station Identification Number (MSIN)

DMobile Country Code (MCC), Mobile Station International Subscriber Directory Number (MSISDN),
Integrated Circuit Card Identification (ICCID)

Correct Answer: C. Mobile Country Code (MCC), Mobile Network Code (MNC), Mobile Station Identification Number (MSIN)

Question 5

What is being shown in the image below?

AAn outgoing call that was not answered

BA call that was answered but immediately hung up

CA missed Skype message on an android device

DA call that was answered and lasted 5 seconds

Correct Answer: A. An outgoing call that was not answered

Question 6

Which of the following devices below runs the Apple iOS operating system?

AApple TV

BMacBook Pro

CiPod Touch

DApple Watch

Correct Answer: C. iPod Touch

Explanation:

including the iPhone, iPad and iPod Touch. The Apple watch runs Watch OS, which is similar to iOS. MacBook

Pros run Mac OSX and the Apple TV is using a new operating system called tvOS.

Question 7

Which of the following files contains details regarding the encryption state of an iTunes backup file?

AKeychain-backup.plist

BManifest.mbdb

CManifest.plist

DStatus.plist

Correct Answer: C. Manifest.plist

Question 8

While analysis in BlackBerry application list it appears that no third-party applications were installed on the device. Which other file may provide you with additional information on applications that were accessed with the handset?

ABlackBerry NV Items

BContent Store

CEvent logs

DBBThumbs.dat

Correct Answer: C. Event logs

Question 9

The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

AThe Android is not rooted

BNo ROM changes have ever occurred on this device

CThe Original/Factory ROM is booting

DThe Original ROM was at one time modified

Correct Answer: C. The Original/Factory ROM is booting

Explanation:

https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

Question 10

Which of the following can most forensics tools crack on an iOS device?

ATouch (fingerprint) ID

BSimple passcode

CPassphrase

Correct Answer: B. Simple passcode