A security analyst is correlating Windows event logs with prefetch files to determine if a specific executable was run by a user. The Security log has Event ID 4688 enabled, but the log is missing entries for the time period in question. Which alternative source would provide the MOST reliable evidence of the executable's execution?

The user's recent items in the Start menu, which show recently opened files.

The prefetch file for the executable, which records the last run time and the volume serial number.

The Application event log, which may contain errors or warnings from the executable.

The System event log, which may contain Event ID 7045 for service installation if the executable was installed as a service.

During a live response, you need to capture volatile memory from a Windows system suspected of running malware. Which approach would be MOST appropriate to preserve the memory evidence?

Run the memory acquisition tool from the system's hard drive to ensure it is the correct version.

Copy the pagefile.sys file to an external drive and analyze it as a memory image.

First, shut down the system gracefully to avoid data corruption, then acquire memory from the hibernation file.

Use a trusted memory acquisition tool from a write-protected USB drive to dump memory to an external drive.

An employee is suspected of leaking confidential documents via a web-based email service. You have the employee's Windows 10 workstation. Which combination of artifacts would provide the most reliable evidence of the upload activity?

Browser history showing visits to the email service's upload page, and the browser cache containing a copy of the uploaded document.

The browser's download history showing a file with the same name as the confidential document.

Prefetch files for the browser and the email service's desktop client, if installed.

The document's file metadata showing the last accessed time, and the system's event logs showing a USB drive was connected.

GIAC Certified Forensic Examiner

Domain 5Objective 1

File and Program Analysis GCFE Practice Questions (Page 3)

Part of the File and Program Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 11–15

11foundation · easy
During a forensic examination, you encounter a file with the extension '.jpg'. Which file signature would confirm that it is a JPEG image?
Select an answer first
12foundation · easy
You are correlating user activity with system events. Which Windows log is most likely to contain records of user logon and logoff events?
Select an answer first
13expert · hard
A security analyst is correlating Windows event logs with prefetch files to determine if a specific executable was run by a user. The Security log has Event ID 4688 enabled, but the log is missing entries for the time period in question. Which alternative source would provide the MOST reliable evidence of the executable's execution?
Select an answer first
14application · medium
During a live response, you need to capture volatile memory from a Windows system suspected of running malware. Which approach would be MOST appropriate to preserve the memory evidence?
Select an answer first
15application · medium
An employee is suspected of leaking confidential documents via a web-based email service. You have the employee's Windows 10 workstation. Which combination of artifacts would provide the most reliable evidence of the upload activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

File and Program Analysis GCFE Practice Questions (Page 3)

Questions 11–15

During a forensic examination, you encounter a file with the extension '.jpg'. Which file signature would confirm that it is a JPEG image?

You are correlating user activity with system events. Which Windows log is most likely to contain records of user logon and logoff events?

During a live response, you need to capture volatile memory from a Windows system suspected of running malware. Which approach would be MOST appropriate to preserve the memory evidence?

An employee is suspected of leaking confidential documents via a web-based email service. You have the employee's Windows 10 workstation. Which combination of artifacts would provide the most reliable evidence of the upload activity?

Keep studying — File and Program Analysis