Browser Structure and Analysis GCFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a forensic examination, you notice that the browser's cache contains a large number of images from a website, but the history database shows no visits to that site. Which browser component behavior best explains this discrepancy?

   • AThe user manually downloaded the images using the browser's download manager.
   • BThe browser's networking component may prefetch or preload resources from a site without recording a history entry.
   • CThe storage component saved the images as part of a service worker's background sync.
   • DThe rendering engine cached the images while displaying a page, but the history was cleared separately.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An examiner is analyzing a suspect's browser data to determine whether they remained logged into a web-based email service during a specific period. Which artifact would provide the most direct evidence of an active authenticated session?

   • AThe browser's form autofill data containing the user's email address.
   • BThe browser's download history showing an attachment downloaded from the email service.
   • CThe browser's cache containing the email service's logo image.
   • DA session cookie with an expiration timestamp that covers the period in question.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a common method for recovering deleted browser history from a storage device?

   • AUsing the browser's 'Undo' feature to restore deleted history.
   • BRestoring the browser's default settings to recover deleted data.
   • CCarving for SQLite database pages from unallocated space.
   • DReinstalling the browser to recover deleted files.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A user claims they never visited a particular website, but the site's cookies are present in their Chrome profile. Which forensic explanation is most plausible?

   • AThe cookies were placed by a malware that modified the browser profile.
   • BThe cookies were set by a third-party script embedded in another site the user visited.
   • CThe cookies are from a previous installation of Chrome that was restored from backup.
   • DThe user visited the site in an incognito window, which still saves cookies.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of browser profiles in terms of data isolation?

   • ATo allow multiple browser versions to run simultaneously on the same machine.
   • BTo improve browser performance by caching data separately for each website.
   • CTo separate user data such as history, cookies, and bookmarks for different users or sessions.
   • DTo encrypt all user data to prevent forensic analysis.
   Reveal Solution Discussion Select an answer first