GIAC Certified Forensic Examiner
Domain 3Objective 2
Browser Forensic Artifacts GCFE Practice Questions (Page 3)
Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)
45questions here
9free pages
6concepts
Questions 11–15
- 11
A forensic examiner is analyzing a Windows 10 system and needs to determine the user's browsing activity for a specific date. The examiner has identified the user profile directory. Which set of files should the examiner prioritize for timeline reconstruction?
Select an answer first - 12
An examiner is analyzing Firefox artifacts on a Linux system. The examiner needs to find the user's saved form data and search terms. Which file should the examiner examine?
Select an answer first - 13
When reconstructing a timeline from browser artifacts, which artifact would provide the most precise timestamp for when a user downloaded a specific file?
Select an answer first - 14
An examiner is investigating a case where a user is suspected of using a browser's private mode to hide activity. The examiner has a full disk image. Which approach would best help identify traces of private browsing activity?
Select an answer first - 15
During a forensic examination of a Windows system, you need to identify the browser artifact that would most likely contain a record of the URLs a user visited, along with the times of those visits. Which category of browser artifact is this?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.