GIAC Certification GIAC Certified Forensic Analyst 2

Question 1

What is the correct order of volatility when collecting digital evidence (most to least volatile)?

Accepted Answer

CPU registers, RAM, Network, Disk

Answer

Disk, RAM, Network, CPU registers

Answer

RAM, Network, Disk, Backup tapes

Answer

Network, RAM, Disk, CPU registers

Question 2

Which Windows Registry hive stores user-specific configuration and is loaded when a user logs in?

Accepted Answer

HKCU (NTUSER.DAT)

Answer

HKLM\SYSTEM

Answer

HKLM\SOFTWARE

Answer

HKLM\SAM

Question 3

What forensic artifact records user web browsing activity including visited URLs, download history, and cached files?

Accepted Answer

Browser artifacts

Answer

Prefetch

Answer

LNK files

Answer

Jump lists

Question 4

What is file carving in digital forensics?

Accepted Answer

Recovering files from unallocated disk space based on file signatures

Answer

Encrypting files for secure transport

Answer

Splitting large forensic images into smaller chunks

Answer

Verifying file integrity with hashes

Question 5

Which Windows log records successful and failed logon events relevant to forensic investigations?

Accepted Answer

Security log

Answer

System log

Answer

Application log

Answer

Setup log

Question 6

What does the GCFA exam primarily assess candidates on?

Accepted Answer

Advanced incident response and computer forensic analysis

Answer

Network firewall configuration

Answer

Secure software development

Answer

Cloud security architecture