GIAC Battlefield Forensics and Acquisition
Domain 2Objective 2
Windows Filesystems GBFA Practice Questions (Page 6)
Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)
27questions here
6free pages
3concepts
Questions 26–27
- 26
A forensic examiner is analyzing an NTFS volume and finds a file that has been modified. Which NTFS artifact would provide the most detailed record of changes to the file's metadata?
Select an answer first - 27
Which feature distinguishes exFAT from traditional FAT32 in terms of maximum file size and cluster size flexibility?
Select an answer first
Finished these 2 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GBFA
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.