A user reports that their browsing history in Chrome shows no entries for a specific date, but the system timeline shows network activity to a known phishing site on that same date. The user claims they were at lunch. Which action would best help determine whether the history was deliberately cleared?

Check the Chrome cache for the phishing site's files; if present, the history was not cleared.

Look at the user's Firefox profile to see if the same site appears in its history.

Examine the Chrome History database for gaps in visit timestamps and check the 'Last Updated' field of the History file.

Verify the system clock was not changed on that date, because an incorrect clock would explain missing history.

In a fraud investigation, you need to prove that a user downloaded a specific PDF from a website. The file is no longer present on the system. Which combination of artifacts would provide the strongest evidence of the download?

A browser history entry for the PDF's URL and a matching cookie.

A cookie from the website and a cache entry for the PDF's thumbnail.

A download record in Chrome's 'History' database with the source URL and a corresponding entry in the system $MFT for the deleted file.

The PDF's filename in the user's 'Recent Documents' list.

An examiner is building a timeline of a user's activities. They have the user's Chrome history, download records, and cookie timestamps. Which approach best correlates these artifacts to establish a sequence of events?

Focus on cookie expiration times to determine when the user was active.

Sort all artifacts by their timestamps and cross-reference URLs, downloads, and cookie creation times.

Use only the browser history timestamps, as they are the most reliable.

Ignore download records because they are not reliable for timeline construction.

A user is suspected of logging into a banking site from a corporate computer. The browser history shows the banking site's homepage, but no login page. Which cookie-related evidence would best indicate that a login occurred?

A cookie named 'sessionid' with a value that is a long random string.

A cookie that is flagged as 'HttpOnly'.

A persistent cookie for the banking domain with an expiration date far in the future.

A session cookie for the banking domain with a 'Last Accessed' timestamp that matches the time of the homepage visit.

GIAC Certified Forensic Examiner

Domain 3Objective 1

Browser Structure and Analysis GCFE Practice Questions (Page 5)

Part of the Browser Forensics domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

12concepts

Questions 21–25

21application · medium
A user reports that their browsing history in Chrome shows no entries for a specific date, but the system timeline shows network activity to a known phishing site on that same date. The user claims they were at lunch. Which action would best help determine whether the history was deliberately cleared?
Select an answer first
22application · medium
In a fraud investigation, you need to prove that a user downloaded a specific PDF from a website. The file is no longer present on the system. Which combination of artifacts would provide the strongest evidence of the download?
Select an answer first
23foundation · easy
In a typical Chrome browser profile on Windows, which file is the primary database that stores the user's browsing history?
Select an answer first
24application · medium
An examiner is building a timeline of a user's activities. They have the user's Chrome history, download records, and cookie timestamps. Which approach best correlates these artifacts to establish a sequence of events?
Select an answer first
25application · medium
A user is suspected of logging into a banking site from a corporate computer. The browser history shows the banking site's homepage, but no login page. Which cookie-related evidence would best indicate that a login occurred?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Browser Structure and Analysis GCFE Practice Questions (Page 5)

Questions 21–25

In a fraud investigation, you need to prove that a user downloaded a specific PDF from a website. The file is no longer present on the system. Which combination of artifacts would provide the strongest evidence of the download?

In a typical Chrome browser profile on Windows, which file is the primary database that stores the user's browsing history?

An examiner is building a timeline of a user's activities. They have the user's Chrome history, download records, and cookie timestamps. Which approach best correlates these artifacts to establish a sequence of events?

A user is suspected of logging into a banking site from a corporate computer. The browser history shows the banking site's homepage, but no login page. Which cookie-related evidence would best indicate that a login occurred?

Keep studying — Browser Forensics