GIAC GCFA Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Forensic Analyst (GCFA) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCFA certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCFA Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Certified Forensic Analyst (GCFA) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Forensic Analyst exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCFA Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCFA Sample Questions:
01. Which two capabilities allow a response team to answer a question across thousands of hosts within an hour?
(Choose two.)
a) A configuration management platform that can push a script to every host on a schedule.
b) An endpoint agent that accepts a query and returns structured results from every host at once.
c) A network monitoring platform recording the traffic each host generated at the perimeter.
d) A centrally aggregated log platform holding the relevant telemetry from those hosts.
02. An account's shortcut and jump-list artifacts are conspicuously empty on a host that this account has used daily for two years.
Which two explanations must the examiner distinguish?
(Choose two.)
a) The artifacts were deliberately cleared, which several utilities and a few built-in settings will do.
b) The artifacts expired, since the shell retains them for a fixed period and discards older entries.
c) The account's profile folders are redirected to a network location, so these artifacts are not written to this host.
d) The account has never signed in interactively, so no shell state was ever created for it.
03. Why is the repository underlying Windows Management Instrumentation examined during a persistence review?
a) It records every management query the host has answered, which reveals reconnaissance activity.
b) It can hold a permanent event subscription that runs attacker code whenever a condition is met.
c) It stores the drivers the management subsystem loads, which an attacker can replace with their own.
d) It caches the credentials that management scripts use to authenticate to remote hosts.
04. A binary's entry in the application compatibility cache is absent, but a Prefetch record for it exists.
What is the most likely explanation?
a) The binary was digitally signed, and signed binaries are excluded from the cache by design.
b) The Prefetch record is a residue from a different binary whose name happened to match.
c) The binary was executed from a removable volume, which the cache does not record.
d) The cache's in-memory contents had not been written to the registry before the host was last powered down.
05. Deleted items on a volume are held in per-account subfolders of the Recycle Bin.
What does that structure give an examiner?
a) A copy of each item's security descriptor, preserved so permissions survive a restore.
b) The original volume each item was deleted from, encoded in the subfolder's name.
c) Attribution of each deletion to the account whose identifier names the subfolder.
d) The order in which the deletions occurred, since the subfolders are numbered sequentially.
06. An examiner finds that Prefetch has been disabled on a workstation, and the estate's standard build leaves it enabled.
How should this be treated?
a) As evidence that no program executed on the host during the period under investigation.
b) As a performance optimization applied by an administrator, since the setting exists for that purpose.
c) As an indication that the host was rebuilt from a non-standard image at some point.
d) As a deliberate reduction in what the host records, to be dated and correlated with other activity.
07. The device enumeration keys give a removable device's first-connection time, and the examiner needs corroboration from a source that is not the registry.
Which artifact provides it?
a) The Amcache hive, which records the device's driver binaries together with their hashes.
b) The device setup log written under the Windows directory, which timestamps each device installation.
c) The Prefetch directory, which records the installer executing at the moment the device was attached.
d) The SRUM database, which attributes resource consumption to the device's driver.
08. An intrusion has reached domain-level privilege. What does that change about the eradication plan?
a) The credential material underpinning the domain must be treated as compromised, and reset in a planned sequence.
b) The response can move directly to recovery, since domain-level access leaves unambiguous evidence to scope from.
c) Nothing structural, since eradication is performed host by host regardless of the privilege obtained.
d) Only the affected hosts need rebuilding, since domain privilege is revoked by disabling the account used.
09. Why is containment across an estate usually planned to take effect at one time rather than host by host?
a) Because regulatory notification requires that all affected systems be secured before the clock starts.
b) Because the monitoring platform cannot correlate events across hosts contained at different times.
c) Because staggered containment gives an operator who is watching time to move to hosts not yet contained.
d) Because contained hosts cannot be re-contained, so an incorrect order cannot be undone.
10. Inside a legitimate process, a committed private region that no mapped file backs begins with the structure of an executable file header.
What does that suggest?
a) That the process was started from an image the loader failed to parse correctly.
b) That an entire executable was written into the process's address space rather than loaded from a file.
c) That the region holds a crash dump the process wrote for itself after an unhandled fault.
d) That the process has memory-mapped a file for reading, which places its content in the address space.
Answers:
|
Question: 01 Answer: b, d |
Question: 02 Answer: a, c |
Question: 03 Answer: b |
Question: 04 Answer: d |
Question: 05 Answer: c |
|
Question: 06 Answer: d |
Question: 07 Answer: b |
Question: 08 Answer: a |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: For any error in GIAC Certified Forensic Analyst (GCFA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
