An analyst is investigating a Windows 10 workstation where a user allegedly accessed sensitive files and then attempted to hide the activity. The analyst needs to determine which USB storage devices were connected and when, and also identify the most recently executed applications. Which combination of registry hives and artifacts should the analyst prioritize?

SOFTWARE hive for Windows Update history, and the AmCache.hve for installed applications

SYSTEM hive for USBSTOR and MountedDevices keys, and the UserAssist key in the NTUSER.DAT hive

SAM hive for user account details, and the BCD hive for boot configuration

NTUSER.DAT for typed paths in the RunMRU key, and the SECURITY hive for logon sessions

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 10)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 46–46

46application · medium
An analyst is investigating a Windows 10 workstation where a user allegedly accessed sensitive files and then attempted to hide the activity. The analyst needs to determine which USB storage devices were connected and when, and also identify the most recently executed applications. Which combination of registry hives and artifacts should the analyst prioritize?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

System and Device Analysis GCFE Practice Questions (Page 10)

Questions 46–46

Keep studying — System and Device Analysis