Which of the following is an example of a browser-generated forensic artifact that records the exact time a user visited a specific URL?

A cookie with a session identifier

An entry in the browser's history database

A browser extension's configuration file

What is the primary purpose of correlating browser artifacts with system timelines in a forensic investigation?

To recover deleted browser files from unallocated space.

To determine the IP address of the user's machine.

To establish a sequence of user activities by aligning timestamps from multiple sources.

To compare browser versions to identify the browser used.

In an investigation, you need to locate saved form data (e.g., names, addresses) from a suspect's Edge browser. Where should you look?

In the Windows registry under 'HKCU\Software\Microsoft\Edge\FormData'.

In the 'Web Data' SQLite database within the Edge profile folder.

In the 'formhistory.sqlite' file in the Edge profile folder.

In the 'Preferences' JSON file in the Edge profile folder.

A user is suspected of using a browser's 'private mode' to visit a prohibited site. The browser history and cache show no trace of the visit. Which additional source of evidence might still reveal the activity?

The Windows Prefetch files, which may show that the browser executable was run, but not the specific site.

The browser's 'Last Session' file, which may be restored after a crash.

The system's DNS cache, which may contain the domain name of the site visited, even in private mode.

The browser's telemetry, which may send usage data to the vendor, but it typically does not include full URLs.

A forensic analyst is examining a Windows system and wants to identify browser telemetry data that might reveal user activity even when history and cache are cleared. Which of the following is a browser-generated telemetry artifact that could provide such evidence?

Chrome's 'Preferences' file, which contains a list of recently closed tabs.

The Windows Event Log, which records every URL visited by the browser.

The browser's cookie database, which stores the full text of visited pages.

The browser's cache index, which is never cleared even when the user clears history.

GIAC Certified Forensic Examiner

Domain 3Objective 1

Browser Structure and Analysis GCFE Practice Questions (Page 4)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 16–20

16foundation · easy
Which of the following is an example of a browser-generated forensic artifact that records the exact time a user visited a specific URL?
Select an answer first
17foundation · easy
What is the primary purpose of correlating browser artifacts with system timelines in a forensic investigation?
Select an answer first
18application · medium
In an investigation, you need to locate saved form data (e.g., names, addresses) from a suspect's Edge browser. Where should you look?
Select an answer first
19expert · hard
A user is suspected of using a browser's 'private mode' to visit a prohibited site. The browser history and cache show no trace of the visit. Which additional source of evidence might still reveal the activity?
Select an answer first
20application · medium
A forensic analyst is examining a Windows system and wants to identify browser telemetry data that might reveal user activity even when history and cache are cleared. Which of the following is a browser-generated telemetry artifact that could provide such evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.