Detailed Exam Domain Coverage: GIAC Certified Forensic Analyst (GCFA)
To achieve the GCFA certification, you must prove your ability to hunt for, identify, and counter advanced adversaries. This practice test bank is built to mirror the rigorous domains of the official exam:
-
Incident Response and Forensics (30%): Mastering volatile data collection, deep-dive memory image analysis, and the critical skill of timeline reconstruction to track attacker movements.
-
Malware Analysis (25%): Gaining proficiency in both static and dynamic analysis, utilizing sandbox environments, and correlating Indicators of Compromise (IOCs).
-
Memory Forensics (20%): Acquiring images from Windows and Linux, detecting code injections, and mastering tools like Volatility and RECmd.
-
File System Forensics (15%): Navigating NTFS/FAT structures, recovering deleted artifacts, and investigating $MFT records for hidden data.
-
Reporting and Documentation (10%): Developing forensic reports that maintain the chain of custody and translate technical findings for legal or executive audiences.
Course Description
I developed this course for cyber security professionals who need to move beyond basic response and into the realm of advanced digital forensics. With 1,500 original practice questions, I provide a high-pressure simulation of the 82-question GCFA exam, ensuring you are ready for the 180-minute gauntlet.
Every question in this bank includes a detailed technical explanation for every single option. I believe that in forensics, the “why” is just as important as the “what.” By understanding the underlying structures of memory and file systems, you will be prepared to pass the exam on your very first attempt and, more importantly, handle real-world breaches with confidence.
Sample Practice Questions
-
Question 1: During a memory forensics investigation using the Volatility framework, which plugin is most effective for identifying hidden or unlinked processes that may indicate a rootkit?
-
A. pslist
-
B. psscan
-
C. pstree
-
D. dlllist
-
E. handles
-
F. cmdscan
-
Correct Answer: B
-
Explanation:
-
B (Correct): psscan scans for process objects by looking for pool tags, which allows it to find processes that have been unlinked from the active process list by a rootkit.
-
A (Incorrect): pslist relies on the doubly-linked list of processes; rootkits often hide by removing themselves from this specific list.
-
C (Incorrect): pstree shows the parent-child relationship but still relies on the standard list that can be manipulated.
-
D (Incorrect): dlllist shows loaded dynamic link libraries for a specific process but doesn’t find hidden processes.
-
E (Incorrect): handles lists open handles for a process, which is useful for analysis but not for finding hidden/unlinked process structures.
-
F (Incorrect): cmdscan searches for command-line history in memory, not for the process objects themselves.
-
-
-
Question 2: In an NTFS file system, which specific attribute within the Master File Table ($MFT) contains the standard file timestamps (MACB) commonly used for timeline analysis?
-
A. $DATA
-
B. $FILENAME
-
C. $STANDARD_INFORMATION
-
D. $INDEX_ROOT
-
E. $BITMAP
-
F. $ATTRIBUTE_LIST
-
Correct Answer: C
-
Explanation:
-
C (Correct): The $STANDARD_INFORMATION attribute contains the most commonly used timestamps (Created, Modified, Accessed, MFT Modified) and is the primary target for timeline analysis.
-
B (Incorrect): $FILENAME also contains timestamps, but these are often updated less frequently and are used to detect “timestomping” by comparing them to $STANDARD_INFORMATION.
-
A (Incorrect): $DATA holds the actual content of the file or pointers to the clusters.
-
D (Incorrect): $INDEX_ROOT is used for directory indexing.
-
E (Incorrect): $BITMAP tracks the allocation status of records.
-
F (Incorrect): $ATTRIBUTE_LIST is only used when a file has so many attributes they don’t fit in a single MFT record.
-
-
-
Question 3: While performing dynamic malware analysis in a sandbox, you notice the malware attempts to query the “Product ID” in the Windows Registry and then immediately terminates. What is the most likely reason for this behavior?
-
A. The malware is trying to update itself.
-
B. The malware is performing an anti-forensic/anti-VM check.
-
C. The malware is searching for stored passwords.
-
D. The malware is attempting to encrypt the registry.
-
E. The malware is checking for a valid Windows license to run.
-
F. The malware is creating a persistence mechanism.
-
Correct Answer: B
-
Explanation:
-
B (Correct): Many advanced threats query specific registry keys or hardware IDs to detect if they are running in a virtualized or analysis environment (sandbox) and will “self-terminate” to avoid detection.
-
A (Incorrect): Self-updates usually involve network callbacks, not just a registry query followed by termination.
-
C (Incorrect): Password theft usually involves different registry hives (like SAM) or browser data files.
-
D (Incorrect): Encryption (Ransomware) would continue to run rather than terminate after one check.
-
E (Incorrect): Malware does not generally care about the legality of the OS license.
-
F (Incorrect): Persistence involves adding keys to “Run” or “RunOnce” folders, not just querying a Product ID.
-
-
-
Welcome to the Exams Practice Tests Academy to help you prepare for your GIAC Certified Forensic Analyst (GCFA).
-
You can retake the exams as many times as you want.
-
This is a huge original question bank.
-
You get support from instructors if you have questions.
-
Each question has a detailed explanation.
-
Mobile-compatible with the Udemy app.
-
30-days money-back guarantee if you’re not satisfied.
I hope that by now you’re convinced! And there are a lot more questions inside the course.
