GIAC Certification GIAC Certified Forensic Analyst

Question 1

Which GIAC certification validates expertise in digital forensics and advanced incident response skills?

Accepted Answer

GCFA

Answer

The GIAC Certified Forensic Analyst (GCFA) certifies professionals in conducting advanced digital forensic investigations and incident response.

Question 2

What type of forensic analysis examines RAM contents to identify running processes, network connections, and malware artifacts?

Accepted Answer

Memory forensics

Answer

Memory forensics analyzes volatile RAM data to uncover running processes, injected code, encryption keys, and attacker activity.

Question 3

Which Volatility command lists running processes from a Windows memory image in a parent-child tree format?

Accepted Answer

pstree

Answer

The Volatility 'pstree' command displays processes in a hierarchical parent-child tree format, helping identify suspicious process relationships.

Question 4

What Windows artifact stores a list of recently executed programs and is useful for forensic timeline reconstruction?

Accepted Answer

Prefetch files

Answer

Windows Prefetch files record program execution details including timestamps and file paths, serving as evidence of program execution.

Question 5

What is the Master File Table (MFT) in NTFS forensics?

Accepted Answer

A database containing metadata for every file and folder on an NTFS volume

Answer

The NTFS Master File Table ($MFT) contains a record for every file and directory, storing metadata like timestamps, permissions, and file location.

GIAC Certification Practice Test