GIAC Certification GIAC Certified Forensic Analyst 2

Question 1

What is the correct order of volatility when collecting digital evidence (most to least volatile)?

Accepted Answer

CPU registers, RAM, Network, Disk

Answer

The order of volatility from most to least is: CPU registers/cache, RAM, network state, running processes, then disk and removable media.

Question 2

Which Windows Registry hive stores user-specific configuration and is loaded when a user logs in?

Accepted Answer

HKCU (NTUSER.DAT)

Answer

HKCU (backed by NTUSER.DAT in the user's profile) stores per-user settings including recently accessed files and application preferences.

Question 3

What forensic artifact records user web browsing activity including visited URLs, download history, and cached files?

Accepted Answer

Browser artifacts

Answer

Browser artifacts including history databases, cookies, cache, and downloads provide a detailed record of user web activity.

Question 4

What is file carving in digital forensics?

Accepted Answer

Recovering files from unallocated disk space based on file signatures

Answer

File carving recovers deleted files from unallocated disk space by searching for known file header and footer signatures without relying on filesystem metadata.

Question 5

Which Windows log records successful and failed logon events relevant to forensic investigations?

Accepted Answer

Security log

Answer

The Windows Security Event Log records authentication events including logon success (Event ID 4624) and failure (Event ID 4625).

GIAC Certification Practice Test

GIAC Certification Practice Test

GIAC Certification GIAC Certified Forensic Analyst 2