Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple70

Home
GIAC
Security Certification: GASF
GASF
GIAC Advanced Smartphone Forensics Questions and Answers

Pass the GIAC Security Certification: GASF GASF Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam GASF Premium Access

View all detail and faqs for the GASF exam

Go to Exam

445 Students Passed

97% Average Score

91% Same Questions

Viewing page 1 out of 3 pages

Viewing questions 1-10 out of questions

Questions # 1:

What is the essential piece of information is most often required in order to decrypt the contents of BlackBerry OS 10 handsets?

Options:

BlackBerry Blend username/pin

BlackBerry Balance username/password

BlackBerry Link ID/password

BBM pin

Answer

Questions # 2:

Which file, located on the Android file system, may be examined to correlate files related to external SD cards that were once used in an Android device?

Options:

Internal.db

Main.db

DataManager. Db

external.db

Answer

Explanation

Explanation

Most of the data stored on the SD and eMMC cards are stored in the external .db or emmc.db file in the /data/data/com.android.providers.media file. This file will remain persistent even if the SD card is removed. This means that files and file names associated with SD cards previously in the device can be recovered and examined. This is a great way to tie an SD card back to a device.

Questions # 3:

Which of the following devices below runs the Apple iOS operating system?

Options:

Apple TV

MacBook Pro

iPod Touch

Apple Watch

Answer

Explanation

Explanation

iOS devices can be defined as Apple products running the Apple iPhone operating system

including the iPhone, iPad and iPod Touch. The Apple watch runs Watch OS, which is similar to iOS. MacBook

Pros run Mac OSX and the Apple TV is using a new operating system called tvOS.

Questions # 4:

Which artifact must be carved out manually when examining a file system acquisition of an Android device?

Options:

Deleted images

Contacts

SMS messages

Phone numbers

Answer

Explanation

Explanation

Questions # 5:

An analyst is reviewing the contents of a media card that was found without an associated device. Based on the image below, with which mobile device is it most likely that this device was once paired?

Question # 5

Options:

Android smartphone

Chinese Knock-off

Legacy BlackBerry

Nokia device running Symbian OS

Answer

Explanation

Explanation

Legacy BlackBerry applications are written in JAVA and are compiled into .cod files for the

device. The existence of these files on a media card could suggest that the card is associated with this type of device.

Questions # 6:

Which of the following is required in addition to the Apple ID of the custodian to access IOS backup files that are stored in ICloud?

Options:

iTunes password

Device passcode

Manifest.plist

Keychain-backup.plist

Answer

Explanation

Explanation

Questions # 7:

Based on the image below, which file system is being examined?

Question # 7

Options:

Chinese knock-off

Windows

Android

Blackberry

Answer

Explanation

Explanation

[Reference:https://forums.techguy.org/threads/virus-in-china-mobile.992051/]

Questions # 8:

What does the data string highlighted in blue represent in the File system path?

Question # 8

Options:

Code name and build number

Phone nick name and serial number

Device user name and phone number

Volume name and network ID

Answer

Explanation

Explanation

The data string for the device is represented in the highlighted section and can be converted and separated to Brighton with a build number of 10B146.

Questions # 9:

What type of acquisition has occurred for this device?

Question # 9

Options:

Physical

File system

Bypass lock

Logical

Answer

Explanation

Explanation

[Reference:https://archive.org/stream/Defcon20Slides/DEFCON-20-Robinson-Spy-vs-Spy_djvu.txt]

Questions # 10:

What will happen when a user creates an encrypted backup of their personal iPhone on their work computer then later performs a backup to their personal computer at home?

Options:

The user will not be able to create the backup until they have deleted the original on their work computer

The user will be required to enter a new backup password on their personal computer

The user will be required to enter their backup password to start the backup process

The user will not need to enter a password on the personal computer

Answer

Explanation

Explanation

Viewing page 1 out of 3 pages

Viewing questions 1-10 out of questions

Modal title

Registered Required

In order to participate in the comments you need to be logged-in.
You can sign-up or login (it's free).

TOP CODES

Top selling exam codes in the certification world, popular, in demand and updated to help you pass on the first try.

2V0-11.25

ADM-201

Agentforce-Specialist

CMMC-CCP

Data-Cloud-Consultant

PCNSE

PDI

PSE-Strata-Pro-24

Secure-Software-Design

Sharing-and-Visibility-Architect

Workday-Pro-Integrations

ZDTA