GIAC Certified Forensic Examiner
Domain 6Objective 1
User Artifact Analysis GCFE Practice Questions (Page 4)
Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)
45questions here
9free pages
9concepts
Questions 16–20
- 16
Which file system artifact records changes to files and directories in a journal that can be used to track file creation, deletion, and modification?
Select an answer first - 17
You are analyzing a Windows 10 system and need to determine if a file was accessed after it was supposedly deleted. Which file system artifact would be most useful for this determination?
Select an answer first - 18
Why is proper documentation of user artifacts important in a forensic investigation?
Select an answer first - 19
Which type of user artifact is most likely to reveal a user's web browsing history?
Select an answer first - 20
Which registry key records the paths that a user typed into the Windows Explorer address bar?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.