VIP Exclusive

GCFA GIAC Certified Forensic Analyst VIP Practice Exam

GCFA — The GCFA (GIAC Certified Forensic Analyst) is issued by GIAC and aligned with SANS FOR508 (Advanced Incident Response, Threat Hunting, and Digital Forensics); the real exam consists of 82 questions, a 2-hour time limit, and a 71% passing threshold, covering Windows forensics, memory analysis, timeline analysis, threat hunting, and incident response.

30
Questions
120m
Time Limit
71.00%
To Pass
Question 1 of 30👑 VIP

During an incident response engagement, you acquire a memory image from a compromised Windows 10 workstation. When running Volatility's 'pslist' plugin, you notice a process named 'svchost.exe' with a parent PID pointing to 'explorer.exe'. What conclusion should you draw from this finding?

Questions 2–30 and full explanations are VIP-exclusive.