Which registry key is commonly analyzed to determine which programs run automatically at system startup?

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SECURITY\Policy

HKEY_CURRENT_USER\Control Panel\Desktop

Which type of data is most likely to be recoverable through file carving?

Files that were securely wiped using a data destruction tool

Files that were encrypted with strong encryption

Files that were deleted and whose clusters have not yet been overwritten

Files that are stored in the cloud and not on the local device

Which Windows registry hive contains information about the currently logged-on user's settings and activity?

HKEY_CURRENT_USER (loaded from the NTUSER.DAT hive)

What is a critical requirement for forensic reports to be admissible in court?

The report must be written in technical jargon to show expertise

The report must clearly document the methods used and the chain of custody

The report must be signed by a law enforcement officer

The report must include every piece of data found on the device

An examiner is analyzing a Windows 10 system and finds a shortcut file (.lnk) in the user's Startup folder. What can this indicate?

The program was recently executed by the user.

The program will start automatically when the user logs on.

The program was installed by the user.

The program is a system service.

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 9)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 41–45

41foundation · easy
Which registry key is commonly analyzed to determine which programs run automatically at system startup?
Select an answer first
42foundation · easy
Which type of data is most likely to be recoverable through file carving?
Select an answer first
43foundation · easy
Which Windows registry hive contains information about the currently logged-on user's settings and activity?
Select an answer first
44foundation · easy
What is a critical requirement for forensic reports to be admissible in court?
Select an answer first
45application · medium
An examiner is analyzing a Windows 10 system and finds a shortcut file (.lnk) in the user's Startup folder. What can this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.