An examiner is investigating a case where a user allegedly downloaded a confidential document from a company portal. The user's browser history has been cleared. Which artifact is most likely to still contain evidence of the download?

The browser's form autofill data, which includes file download records.

The browser's download database, which records the file name, source URL, and timestamp.

The browser's cookie jar, which stores the document's content.

The browser's cache, which stores the document's full content.

Which of the following is an example of browser telemetry data that may be recorded and sent to the browser vendor?

The full content of web pages visited

Crash reports and usage statistics such as feature usage and performance metrics

The user's browsing history in full detail

What is the primary forensic value of analyzing a browser's cache files?

To recover web content that may no longer be available online.

To reconstruct the user's search history.

To determine the exact time a user logged into a website.

To identify the user's saved passwords.

An examiner is analyzing a Windows system that has both Chrome and Firefox installed. The user primarily uses Chrome, but the examiner finds relevant browsing activity in Firefox's history. Which conclusion is most appropriate?

The Firefox activity is irrelevant because the user primarily uses Chrome.

The Firefox history was created by Chrome's telemetry, so it is not user activity.

The user may have used Firefox for some activities, and both browsers' artifacts should be examined.

The Firefox history is a copy of Chrome's history, so only one needs to be analyzed.

GIAC Certified Forensic Examiner

Domain 3Objective 1

Browser Structure and Analysis GCFE Practice Questions (Page 2)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 6–10

6application · medium
An examiner is investigating a case where a user allegedly downloaded a confidential document from a company portal. The user's browser history has been cleared. Which artifact is most likely to still contain evidence of the download?
Select an answer first
7foundation · easy
Which of the following is an example of browser telemetry data that may be recorded and sent to the browser vendor?
Select an answer first
8foundation · easy
Which database table in Chrome's History file is primarily used to reconstruct the sequence of pages visited in a single browsing session?
Select an answer first
9foundation · easy
What is the primary forensic value of analyzing a browser's cache files?
Select an answer first
10application · medium
An examiner is analyzing a Windows system that has both Chrome and Firefox installed. The user primarily uses Chrome, but the examiner finds relevant browsing activity in Firefox's history. Which conclusion is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.