A forensic examiner is reviewing installed applications on a Windows 10 system. They find an application listed in the registry under 'Uninstall' keys, but the corresponding executable file is missing from the file system. Which conclusion is MOST appropriate?

The application is still installed, but the executable is hidden.

The application was uninstalled, but the registry entry was not removed, which is a common artifact.

The application is a portable application that does not require installation.

The application was never installed, and the registry entry is a false positive.

An examiner is analyzing a file named 'report.pdf' found on a suspect's drive. The file's header is '%PDF-1.7', but the file's extension is .pdf. The examiner also notes that the file's creation time is 2 years before the suspect's computer was purchased. The examiner wants to determine if the file is a legitimate PDF or if it has been altered. Which finding would most strongly indicate the file is not a legitimate PDF?

The file's internal metadata shows it was created with a PDF generator that was not available at the claimed creation time

The file's extension matches its header, suggesting consistency

The file's creation time predates the computer's purchase, indicating it was copied from another system

The file's header is '%PDF-1.7', which is a valid PDF signature

A user is suspected of accessing a specific website at a certain time. The browser history shows the URL, but the timestamp is missing. Which other artifact could help confirm the time of access?

The user's recent documents list, which shows recently opened files.

The user's email client, which may contain a link to the website.

The system's event logs, which record all network connections.

The browser's cache files, which have timestamps indicating when the content was downloaded.

GIAC Certified Forensic Examiner

Domain 5Objective 1

File and Program Analysis GCFE Practice Questions (Page 7)

Part of the File and Program Analysis domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 31–35

31foundation · easy
Which Windows Event Log channel is specifically designed to record events from applications and services, such as errors or warnings from a specific program?
Select an answer first
32application · medium
A forensic examiner is reviewing installed applications on a Windows 10 system. They find an application listed in the registry under 'Uninstall' keys, but the corresponding executable file is missing from the file system. Which conclusion is MOST appropriate?
Select an answer first
33foundation · easy
Which of the following is a common persistence mechanism used by malware on Windows systems?
Select an answer first
34expert · hard
An examiner is analyzing a file named 'report.pdf' found on a suspect's drive. The file's header is '%PDF-1.7', but the file's extension is .pdf. The examiner also notes that the file's creation time is 2 years before the suspect's computer was purchased. The examiner wants to determine if the file is a legitimate PDF or if it has been altered. Which finding would most strongly indicate the file is not a legitimate PDF?
Select an answer first
35application · medium
A user is suspected of accessing a specific website at a certain time. The browser history shows the URL, but the timestamp is missing. Which other artifact could help confirm the time of access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

File and Program Analysis GCFE Practice Questions (Page 7)

Questions 31–35

Which Windows Event Log channel is specifically designed to record events from applications and services, such as errors or warnings from a specific program?

A forensic examiner is reviewing installed applications on a Windows 10 system. They find an application listed in the registry under 'Uninstall' keys, but the corresponding executable file is missing from the file system. Which conclusion is MOST appropriate?

Which of the following is a common persistence mechanism used by malware on Windows systems?

A user is suspected of accessing a specific website at a certain time. The browser history shows the URL, but the timestamp is missing. Which other artifact could help confirm the time of access?

Keep studying — File and Program Analysis