Windows Artifact Analysis GCFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is examining a Windows 10 system for evidence of web-based email access. The user used a browser. Which artifact would provide the most useful evidence of the user's web activity?

   • AThe $MFT entries for temporary internet files
   • BThe browser's history and cache files
   • CThe Security event log
   • DThe user's Prefetch files for the browser
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is investigating a Windows Server 2016 system where a file was accessed via a network share. The analyst has the $MFT, the USN journal, and the Security event log. The $MFT shows a last access time for the file, but the USN journal does not show any record for the file. Which conclusion is most defensible?

   • AThe file was accessed by a local user because network accesses do not update $MFT last access times.
   • BThe file was not accessed because the USN journal does not show a record.
   • CThe file may have been read without modification, and the USN journal does not record pure reads, so the last access time is the primary evidence.
   • DThe file was modified because the $MFT last access time changed.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Windows Event Log is primarily responsible for recording security-related events such as logon attempts, account management, and policy changes?

   • ASecurity
   • BSetup
   • CSystem
   • DApplication
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of a volatile memory artifact that can be correlated with on-disk artifacts?

   • AThe last run time of an application from Prefetch
   • BA list of running processes and their command-line arguments
   • CThe contents of the $MFT
   • DThe list of recently accessed files from Jump Lists
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a Volume Shadow Copy (VSS) in Windows, and why is it valuable in forensic investigations?

   • AA cache of recently executed programs
   • BA log of all network connections made by the system
   • CA backup of the registry hives only
   • DA snapshot of the filesystem at a point in time that can be used to recover previous versions of files
   Reveal Solution Discussion Select an answer first