File and Program Analysis GCFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which browser artifact is used to maintain session state and track user preferences, and can reveal information about a user's online activity?

   • ADownloads
   • BHistory
   • CCache
   • DCookies
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An examiner is analyzing a USB drive that was used on both Windows and Linux systems. The drive is formatted with exFAT. The examiner finds a file that was deleted, but the file's directory entry is still present. Which aspect of exFAT allows the examiner to recover the file's metadata?

   • AThe file's content is stored in the directory entry itself, so deletion only removes the file's name
   • BexFAT creates a backup of every file in the $LogFile, allowing full recovery
   • CThe directory entry remains in the FAT until it is overwritten, preserving the file's name, size, and timestamps
   • DThe file's data is moved to a hidden system area, preserving the original file structure
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is analyzing a compromised Windows Server 2019 system. The examiner finds a scheduled task named 'WindowsUpdate' that runs a PowerShell script from C:\ProgramData\temp\update.ps1 every 5 minutes. The script downloads a payload from a remote server. The examiner wants to determine when this persistence mechanism was first established. Which artifact would provide the most reliable timeline for the creation of this scheduled task?

   • AThe 'Creation date' property of the scheduled task's .job file in C:\Windows\System32\Tasks
   • BThe 'Last Run Time' field in the Task Scheduler's task status
   • CThe 'Modified' timestamp of the PowerShell script in C:\ProgramData\temp
   • DThe 'Date' field in the Windows Event Log entry for the task's first execution
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During a forensic examination, you need to determine which websites a user visited using Google Chrome. Which browser artifact should you analyze?

   • ACache folder
   • BCookies database
   • CBookmarks file
   • DHistory database (History file)
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is examining a Windows 10 system and finds an unknown application in the user's AppData\Roaming folder. The application's executable has a valid digital signature, but the signature was issued to a company that is known to be a shell company. The analyst also finds that the application creates a scheduled task at logon. Which finding would most strongly suggest the application is malicious?

   • AThe application's executable has a valid digital signature, indicating it is legitimate
   • BThe application is installed in AppData\Roaming, which is a common location for user-level applications
   • CThe application creates a scheduled task at logon, which is a common persistence mechanism
   • DThe application's digital signature is from a shell company, indicating the software may be untrustworthy
   Reveal Solution Discussion Select an answer first