Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GASF Exam - Topic 6 Question 68 Discussion

The device pictured below is in Download Mode to attempt a physical acquisition.What can be ascertained by viewing the Android boot screen below?
C) The Original/Factory ROM is booting
A) The Android is not rooted
B) No ROM changes have ever occurred on this device
D) The Original ROM was at one time modified

GIAC GASF Exam - Topic 6 Question 68 Discussion

Actual exam question for GIAC's GASF exam
Question #: 68
Topic #: 6
[All GASF Questions]

The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

Show Suggested Answer Hide Answer
Suggested Answer: C

https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

by Royal at May 13, 2026, 08:25 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Alesia
3 days ago
Wait, how can we be sure about the ROM changes?
upvoted 0 times
...
Sage
8 days ago
A) The Android is not rooted for sure!
upvoted 0 times
...
Jovita
13 days ago
I disagree, it could have been modified before.
upvoted 0 times
...
Gilberto
19 days ago
Looks like the device is in Download Mode, so definitely not rooted.
upvoted 0 times
...
Irma
24 days ago
I’m not convinced, this could be misleading.
upvoted 0 times
...
Shannan
29 days ago
A) is correct, no signs of rooting here.
upvoted 0 times
...
Mammie
1 month ago
Wait, how can we be sure about the ROM changes?
upvoted 0 times
...
Gerald
1 month ago
I disagree, it could have been modified before.
upvoted 0 times
...
Emilio
1 month ago
Looks like the device is in Download Mode, so definitely not rooted.
upvoted 0 times
...
Nickolas
2 months ago
I recall that if the device is in Download Mode, it doesn't necessarily confirm if it's rooted or not. I think option A could be misleading.
upvoted 0 times
...
Johnna
2 months ago
I’m a bit confused. Does the presence of Download Mode mean the original ROM is still intact? I thought it could indicate modifications too.
upvoted 0 times
...
Galen
2 months ago
I think I came across a similar question where we had to determine if a device was modified based on its boot screen. I feel like option D might be the right choice here.
upvoted 0 times
...
Theresia
4 months ago
I remember studying that Download Mode indicates the device is ready for flashing, but I'm not sure how that relates to rooting.
upvoted 0 times
...

Save Cancel