You are responding to an incident on a Windows Server 2019 system that is still running. You have acquired a memory dump using a trusted tool. The Security event log on disk appears to have been partially cleared, but you need to recover as much event data as possible. Which approach would yield the most volatile event log data from the memory dump?

Use a tool to carve the event log files from unallocated space on the disk

Run a live acquisition of the event log files using a forensic tool on the running system

Reboot the system and then acquire the event log files from the disk

Parse the memory dump with a tool that extracts the event log buffers from the Windows Event Log service's memory pool

You are investigating a system where a service failed to start. In the memory dump, you find Event ID 7000 (Service Control Manager error) from the System log. Which additional event log record would best help you determine why the service failed?

Event ID 7001 (Service Control Manager error) that indicates a dependency service did not start.

Event ID 6005 (Event Log service started) to confirm the system boot time.

Event ID 1074 (system shutdown) to see if the system was shut down improperly.

Event ID 4624 (successful logon) to see which user was logged on during the failure.

You are using a memory forensics tool to parse event log records from a memory dump. You notice that some records have a timestamp that is earlier than the system boot time. What is the most likely explanation?

The system clock was changed during the current session, causing timestamps to appear earlier.

The memory dump is corrupted and the timestamps are unreliable.

The event log service is using a different time zone than the system.

The event log records may have been persisted from a previous boot and loaded into memory when the system started.

Which of the following is a common tool or technique for constructing a timeline from event logs?

Running a network scan to identify active hosts

Using a hex editor to view raw event log data

Sorting parsed events by timestamp using a spreadsheet or timeline tool

Checking the event log file permissions

Which of the following is a common sign that Windows event logs have been cleared?

The event log service is stopped

A sudden increase in the number of event log entries

The event log file size is larger than the default maximum

Event ID 1102 in the Security log indicating the log was cleared

GIAC Certified Forensic Analyst

Domain 2Objective 3

Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 7)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31application · medium
You are responding to an incident on a Windows Server 2019 system that is still running. You have acquired a memory dump using a trusted tool. The Security event log on disk appears to have been partially cleared, but you need to recover as much event data as possible. Which approach would yield the most volatile event log data from the memory dump?
Select an answer first
32application · medium
You are investigating a system where a service failed to start. In the memory dump, you find Event ID 7000 (Service Control Manager error) from the System log. Which additional event log record would best help you determine why the service failed?
Select an answer first
33application · medium
You are using a memory forensics tool to parse event log records from a memory dump. You notice that some records have a timestamp that is earlier than the system boot time. What is the most likely explanation?
Select an answer first
34foundation · easy
Which of the following is a common tool or technique for constructing a timeline from event logs?
Select an answer first
35foundation · easy
Which of the following is a common sign that Windows event logs have been cleared?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.