Browser Structure and Analysis GCFE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the context of browser forensics, which browser component is primarily responsible for interpreting HTML and CSS to render web pages, and why is it relevant to forensic analysis?

   • ARendering engine; it parses HTML/CSS and executes layout, and its version can affect how cached content is stored and displayed.
   • BJavaScript engine; it executes scripts that may leave traces in memory dumps, but it does not handle HTML parsing.
   • CNetworking stack; it determines the IP addresses and ports used for connections, which are logged in system files.
   • DBrowser storage manager; it controls where cookies and cache are saved, but it does not process page content.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are building a timeline of a user's activities. The Chrome history shows a visit to a webmail site at 10:00 AM, and a cookie for that site has a creation timestamp of 10:01 AM. The system's $MFT shows a file downloaded from that webmail at 10:05 AM. Which conclusion is most defensible?

   • AThe user logged into webmail at 10:00 AM, and the cookie was created as part of the login session, followed by a download at 10:05 AM.
   • BThe cookie was created by a background process, and the download was automated by malware.
   • CThe download at 10:05 AM could be unrelated to the webmail visit because the file type is unknown.
   • DThe history timestamp is unreliable because Chrome uses UTC, and the local time is different.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an investigation, you need to recover a specific image that was viewed in Chrome but has since been deleted from the browser cache. The image was never saved to disk by the user. Which approach is most likely to recover the image?

   • ACarve the unallocated space of the system drive for JPEG/PNG file signatures.
   • BRestore the 'Cache_Data' folder from the Recycle Bin.
   • CCheck the Chrome 'History' database for the image URL and re-download it from the internet.
   • DLook in the 'Downloads' folder for the image file.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are analyzing a Chrome cache and find a file with a URL that matches a known malware distribution site. However, the file's HTTP header indicates 'Cache-Control: no-store'. What does this indicate for your investigation?

   • AThe file was cached by a service worker, which is allowed to ignore 'no-store'.
   • BThe file is a false positive because 'no-store' means it was never stored.
   • CThe file may have been stored in memory only and not written to disk, so its presence in the cache is anomalous and warrants further analysis.
   • DThe file is definitely from the malware site, and the user must have visited it.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which browser artifact is most likely to contain a record of a file that a user downloaded, including the source URL and the local path where it was saved?

   • ABrowser cache
   • BCookies
   • CBrowser history
   • DDownloads database
   Reveal Solution Discussion Select an answer first