GIAC Certified Forensic Examiner
Domain 6Objective 1
User Artifact Analysis GCFE Practice Questions (Page 6)
Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)
45questions here
9free pages
9concepts
Questions 26–30
- 26
An examiner is investigating a system where the user has used a portable application (e.g., a USB-based browser) to avoid leaving traces. Which artifact would be most likely to reveal the use of the portable application?
Select an answer first - 27
An examiner is investigating a case involving alleged inappropriate communications via Microsoft Outlook. The user's mailbox is hosted on Exchange Online, but the user also has a local Outlook data file (.pst) on their Windows 10 workstation. Which artifact would provide the most reliable evidence of the user's email communications?
Select an answer first - 28
Which browser artifact is most useful for determining which files a user downloaded from the internet?
Select an answer first - 29
An examiner needs to determine which files a user recently opened on a Windows 10 system. The user has cleared the Recent Items folder. Which registry-based artifact would still provide evidence of recently opened documents?
Select an answer first - 30
An examiner is building a timeline of user activity for a Windows system. The user's NTUSER.DAT shows a last write time of 10:00 AM, but the user's browser history shows activity at 10:30 AM. The system's clock is known to be accurate. Which conclusion is most defensible?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.