GIAC Certification GIAC Certified Forensic Analyst

Question 1

Which GIAC certification validates expertise in digital forensics and advanced incident response skills?

Accepted Answer

GCFA

Answer

GCIH

Answer

GCFE

Answer

GREM

Question 2

What type of forensic analysis examines RAM contents to identify running processes, network connections, and malware artifacts?

Accepted Answer

Memory forensics

Answer

Disk forensics

Answer

Network forensics

Answer

Log analysis

Question 3

Which Volatility command lists running processes from a Windows memory image in a parent-child tree format?

Accepted Answer

pstree

Answer

pslist

Answer

cmdline

Answer

netscan

Question 4

What Windows artifact stores a list of recently executed programs and is useful for forensic timeline reconstruction?

Accepted Answer

Prefetch files

Answer

Event logs

Answer

Registry hives

Answer

MFT records

Question 5

What is the Master File Table (MFT) in NTFS forensics?

Accepted Answer

A database containing metadata for every file and folder on an NTFS volume

Answer

A log of all network connections

Answer

A record of all user login events

Answer

A list of installed software

Question 6

Which anti-forensics technique involves an attacker modifying file timestamps to mislead forensic timeline analysis?

Accepted Answer

Timestomping

Answer

Steganography

Answer

Log wiping

Answer

File carving