An examiner is investigating a possible data exfiltration via a web browser. The examiner has found a suspicious URL in the browser history. Which additional artifact would best help confirm that the user actually accessed the content of that URL?

The 'Login Data' database entry for that domain

The corresponding cache entry for that URL

The 'Top Sites' file entry for that domain

A cookie set by the domain of that URL

An examiner is reconstructing a user's browsing timeline and finds that the Chrome History database has been partially overwritten. Which other artifact could help fill in gaps in the timeline?

The 'Network Action Predictor' database

During a forensic examination, you need to determine what a user typed into a search engine. Which browser artifact would most likely contain this information?

Form history (formhistory.sqlite in Firefox, Web Data in Chrome)

An examiner is collecting browser artifacts from a system that is part of a legal case. The examiner needs to ensure the artifacts are admissible in court. Which action is most important?

Document the chain of custody and maintain a detailed log of all actions taken

Store the evidence in a secure location

Use the latest version of a commercial forensic tool

Perform the acquisition twice to ensure consistency

You are analyzing a user's browsing timeline. The Chrome History shows a visit to a webpage at 10:00:00. The user then downloaded a file at 10:05:00, and the cookie for that domain was last updated at 10:06:00. What is the most likely sequence of events?

Cookie updated, visited page, then downloaded file

Downloaded file, visited page, then cookie updated

Visited page, cookie updated, then downloaded file

Visited page, downloaded file, then the cookie was updated

GIAC Certified Forensic Examiner

Domain 3Objective 2

Browser Forensic Artifacts GCFE Practice Questions (Page 5)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 21–25

21application · medium
An examiner is investigating a possible data exfiltration via a web browser. The examiner has found a suspicious URL in the browser history. Which additional artifact would best help confirm that the user actually accessed the content of that URL?
Select an answer first
22application · medium
An examiner is reconstructing a user's browsing timeline and finds that the Chrome History database has been partially overwritten. Which other artifact could help fill in gaps in the timeline?
Select an answer first
23application · medium
During a forensic examination, you need to determine what a user typed into a search engine. Which browser artifact would most likely contain this information?
Select an answer first
24expert · hard
An examiner is collecting browser artifacts from a system that is part of a legal case. The examiner needs to ensure the artifacts are admissible in court. Which action is most important?
Select an answer first
25application · medium
You are analyzing a user's browsing timeline. The Chrome History shows a visit to a webpage at 10:00:00. The user then downloaded a file at 10:05:00, and the cookie for that domain was last updated at 10:06:00. What is the most likely sequence of events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.