An examiner is investigating a Windows system and wants to identify when a specific executable was first run and how many times it has been executed. Which artifacts should be examined?

Prefetch files and the UserAssist registry key

Shortcut files and the RecentDocs key

The AmCache.hve and the BCD registry hive

An examiner is investigating a Windows 10 system for evidence of unauthorized access. The examiner wants to determine if a user account was created and used, and also identify recently accessed documents. Which registry hives and keys should be examined?

SAM hive for user account creation, and the RecentDocs key in NTUSER.DAT for document access

SYSTEM hive for services, and the ShellBags for folder views

SOFTWARE hive for installed programs, and the UserAssist key for program execution

SECURITY hive for logon sessions, and the RunMRU key for executed commands

An examiner has completed the analysis of a compromised system and is preparing the final report. The report must be understandable to non-technical stakeholders while preserving technical accuracy. What is the most appropriate approach?

Provide an executive summary with key findings, followed by detailed technical sections with supporting evidence

Use highly technical jargon throughout to demonstrate expertise

Include only the raw data and let the stakeholders interpret it

Focus only on the final conclusion and omit the methodology

An examiner has completed the analysis of a hard drive and needs to document the findings. Which element is essential to include in the forensic report to ensure the findings are reproducible?

The hash values of the acquired image and the tools used.

The suspect's name and address.

The examiner's personal notes and opinions.

The cost of the forensic tools used.

Which activity falls within the scope of system and device analysis in digital forensics?

Installing operating system updates to patch vulnerabilities

Examining file system metadata to determine when a document was last modified

Creating user accounts and assigning permissions on a server

Configuring a firewall to block unauthorized network traffic

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 7)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 31–35

31application · medium
An examiner is investigating a Windows system and wants to identify when a specific executable was first run and how many times it has been executed. Which artifacts should be examined?
Select an answer first
32application · medium
An examiner is investigating a Windows 10 system for evidence of unauthorized access. The examiner wants to determine if a user account was created and used, and also identify recently accessed documents. Which registry hives and keys should be examined?
Select an answer first
33expert · hard
An examiner has completed the analysis of a compromised system and is preparing the final report. The report must be understandable to non-technical stakeholders while preserving technical accuracy. What is the most appropriate approach?
Select an answer first
34application · medium
An examiner has completed the analysis of a hard drive and needs to document the findings. Which element is essential to include in the forensic report to ensure the findings are reproducible?
Select an answer first
35foundation · easy
Which activity falls within the scope of system and device analysis in digital forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.