GIAC GASF Exam Questions Instant Access - No Installation Required

Question 1

Using an emulator and running an application through a series of processes to figure out how it would behave on an actual device is called:

AForensic analysis

BDynamic analysis

CWeb analysis

DStatic analysis

Answer : B

Question 2

What type of storage does an iOS device use for user data?

ASSD

BSIM

CNAND

DNOR

Answer : C

Question 3

What is being shown in the image below?

AAn outgoing call that was not answered

BA call that was answered but immediately hung up

CA missed Skype message on an android device

DA call that was answered and lasted 5 seconds

Answer : A

Question 4

How would an examiner review items deleted from a SQLITE database?

AUsing a Hex Viewer

BConverting the database to a txt file

CReviewing the file header

DSelecting the raw data from the table

Answer : A

Question 5

Which of the following is of most concern when attempting to root an Android device such as Google Glass

when conducting a forensic acquisition?

ARooting this device will overwrite the data partition

BThe manufacturer warranty is voided

CDevice security is altered

DTraces of the root are left behind

Answer : A

Question 6

What is the MAIN difference between a Full Root and a Shell/Soft Root?

AFull root is permanent

BFull root Leaves traces behind on the device

CSoft root Allows system level access without a password

DSoft root Utilizes Shell root

Answer : C

Question 7

In 2015, Apple's iTunes store was found to be hosting several malicious applications that were infected as a result of hacked version of the developer toolkit used to create applications. Which Apple developer suite was targeted?

AXcode

BADB

CMomentics IDE

DXamarin

Answer : A

GIAC Advanced Smartphone Forensics GASF Exam Questions