GIAC Certified Forensic Examiner
Domain 3Objective 2
Browser Forensic Artifacts GCFE Practice Questions (Page 9)
Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)
45questions here
9free pages
6concepts
Questions 41–45
- 41
Why is it important to avoid launching the browser during a forensic examination of a suspect's computer?
Select an answer first - 42
You are examining a Chrome History SQLite database. You need to extract the URLs visited and the time of each visit. Which tables should you query?
Select an answer first - 43
An examiner is investigating a case where a user allegedly downloaded a sensitive document from a web application. The examiner has the user's browser profile. Which combination of artifacts would most reliably corroborate the download event?
Select an answer first - 44
An examiner is investigating a case where a user allegedly used a web-based email service to send sensitive information. The examiner has the browser profile. Which combination of artifacts would best corroborate the sending of an email?
Select an answer first - 45
During a forensic examination of a Windows 10 workstation, you need to collect browsing artifacts from Google Chrome. The user's profile is located at C:\Users\mike\AppData\Local\Google\Chrome\User Data\Default. Which file should you prioritize for capturing the user's browsing history?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to GCFE
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.