Check us
GCFAEvery source behind our GCFA questions
Each of these is a published page from GIAC or from the standards body behind the topic. A question was written from the published objectives, then checked against one of them, and the passage it rests on is quoted beside the answer when you get there.
- 128pages
- pages
- 164of 164 questions cited
- of 164 questions cited
- 6source sites
- source sites
- 6exam domains covered
- exam domains covered
The pages themselves
Ordered by how many questions rest on each. The date is when that page was last re-fetched and read, not when the question was written.
- nistpubs / Legacy / SP / nistspecialpublication800 86nvlpubs.nist.gov9 questions · checked 2026-08-28
- techniques / T1070 / 006attack.mitre.org4 questions · checked 2026-08-28
- windows / win32 / fileio / master file tablelearn.microsoft.com4 questions · checked 2026-08-28
- nistpubs / SpecialPublications / NIST.SP.800 61r2nvlpubs.nist.gov4 questions · checked 2026-08-28
- rfc / rfc3227rfc-editor.org4 questions · checked 2026-08-28
- previous versions / windows / it pro / windows 10 / security / threat protection / auditing / event 4624learn.microsoft.com3 questions · checked 2026-08-28
- windows / security / threat protection / use windows event forwarding to assist in intrusion detectionlearn.microsoft.com3 questions · checked 2026-08-28
- windows / win32 / vss / shadow copies and shadow copy setslearn.microsoft.com3 questions · checked 2026-08-28
- techniques / T1003 / 003attack.mitre.org2 questions · checked 2026-08-28
- techniques / T1053 / 005attack.mitre.org2 questions · checked 2026-08-28
- techniques / T1078attack.mitre.org2 questions · checked 2026-08-28
- sysinternals / downloads / sysmonlearn.microsoft.com2 questions · checked 2026-08-28
- windows hardware / drivers / print / print spooler architecturelearn.microsoft.com2 questions · checked 2026-08-28
- windows / win32 / eventlog / eventlog keylearn.microsoft.com2 questions · checked 2026-08-28
- windows / win32 / fileio / file streamslearn.microsoft.com2 questions · checked 2026-08-28
- windows / win32 / shell / about user profileslearn.microsoft.com2 questions · checked 2026-08-28
- windows / win32 / sysinfo / file timeslearn.microsoft.com2 questions · checked 2026-08-28
- nistpubs / Legacy / SP / nistspecialpublication800 92nvlpubs.nist.gov2 questions · checked 2026-08-28
- mitigations / M1053attack.mitre.org1 question · checked 2026-08-28
- techniques / T1003 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1003 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1021 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1036 / 005attack.mitre.org1 question · checked 2026-08-28
- techniques / T1047attack.mitre.org1 question · checked 2026-08-28
- techniques / T1055attack.mitre.org1 question · checked 2026-08-28
- techniques / T1055 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1055 / 012attack.mitre.org1 question · checked 2026-08-28
- techniques / T1059 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1059 / 003attack.mitre.org1 question · checked 2026-08-28
- techniques / T1070attack.mitre.org1 question · checked 2026-08-28
- techniques / T1087 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1134 / 004attack.mitre.org1 question · checked 2026-08-28
- techniques / T1217attack.mitre.org1 question · checked 2026-08-28
- techniques / T1218attack.mitre.org1 question · checked 2026-08-28
- techniques / T1490attack.mitre.org1 question · checked 2026-08-28
- techniques / T1546 / 003attack.mitre.org1 question · checked 2026-08-28
- techniques / T1547 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1550 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1553 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1569 / 002attack.mitre.org1 question · checked 2026-08-28
- techniques / T1571attack.mitre.org1 question · checked 2026-08-28
- techniques / T1574 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1685 / 001attack.mitre.org1 question · checked 2026-08-28
- techniques / T1685 / 005attack.mitre.org1 question · checked 2026-08-28
- defender endpoint / live responselearn.microsoft.com1 question · checked 2026-08-28
- defender endpoint / respond machine alertslearn.microsoft.com1 question · checked 2026-08-28
- defender xdr / advanced hunting overviewlearn.microsoft.com1 question · checked 2026-08-28
- defender xdr / incidents overviewlearn.microsoft.com1 question · checked 2026-08-28
- deployoffice / security / internet macros blockedlearn.microsoft.com1 question · checked 2026-08-28
- dotnet / api / system.io.packaging.packageproperties.lastprintedlearn.microsoft.com1 question · checked 2026-08-28
- openspecs / windows protocols / ms shllink / c3376b21 0931 45e4 b2fc a48ac0e60d15learn.microsoft.com1 question · checked 2026-08-28
- powershell / module / microsoft.powershell.core / about / about logging windowslearn.microsoft.com1 question · checked 2026-08-28
- previous versions / windows / embedded / ms940847(v=winembedded.5)learn.microsoft.com1 question · checked 2026-08-28
- sysinternals / downloads / tcpviewlearn.microsoft.com1 question · checked 2026-08-28
- windows hardware / drivers / debugger / complete memory dumplearn.microsoft.com1 question · checked 2026-08-28
- windows hardware / drivers / gettingstarted / user mode and kernel modelearn.microsoft.com1 question · checked 2026-08-28
- windows hardware / drivers / gettingstarted / virtual address spaceslearn.microsoft.com1 question · checked 2026-08-28
- windows hardware / drivers / gettingstarted / what is a driver learn.microsoft.com1 question · checked 2026-08-28
- windows hardware / drivers / install / authenticodelearn.microsoft.com1 question · checked 2026-08-28
- windows hardware / manufacture / desktop / customize the default user profile by using copyprofilelearn.microsoft.com1 question · checked 2026-08-28
- windows server / administration / windows commands / fsutil behaviorlearn.microsoft.com1 question · checked 2026-08-28
- windows server / administration / windows commands / gpupdatelearn.microsoft.com1 question · checked 2026-08-28
- windows server / administration / windows commands / netstatlearn.microsoft.com1 question · checked 2026-08-28
- windows server / administration / windows commands / sfclearn.microsoft.com1 question · checked 2026-08-28
- windows server / identity / plan / security best practices / audit policy recommendationslearn.microsoft.com1 question · checked 2026-08-28
- windows server / networking / windows time service / windows time service toplearn.microsoft.com1 question · checked 2026-08-28
- windows server / security / credentials protection and management / configuring additional lsa protectionlearn.microsoft.com1 question · checked 2026-08-28
- windows server / storage / file server / volume shadow copy servicelearn.microsoft.com1 question · checked 2026-08-28
- windows / application management / svchost service refactoringlearn.microsoft.com1 question · checked 2026-08-28
- windows / client management / mdm / policy csp storagelearn.microsoft.com1 question · checked 2026-08-28
- windows / deployment / update / how windows update workslearn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 1102learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4624learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4647learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4648learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4663learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4672learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4688learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4697learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4698learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4719learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4732learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4740learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4768learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4769learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 4778learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 5145learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / auditing / event 5156learn.microsoft.com1 question · checked 2026-08-28
- windows / security / threat protection / windows defender application control / applocker / understanding applocker default ruleslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / minwinbase / ns minwinbase filetimelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / shellapi / nf shellapi shfileoperationalearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / thumbcache / nn thumbcache ithumbnailcachelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / timezoneapi / nf timezoneapi systemtimetotzspecificlocaltimelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / timezoneapi / ns timezoneapi time zone informationlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / api / winnt / ns winnt eventlogrecordlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / change journal recordslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / change journalslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / distributed link tracking and object identifierslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / file attribute constantslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / file encryptionlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / file security and access rightslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / hard links and junctionslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / managing disk quotaslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / reparse pointslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / fileio / sparse fileslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / memory / working setlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / msi / uninstall registry keylearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / power / system power stateslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / procthread / about processes and threadslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / procthread / thread handles and identifierslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / search / search indexing process overviewlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / secauthz / dacls and aceslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / services / localservice accountlearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / services / service user accountslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / setupapi / run and runonce registry keyslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / shell / csidllearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / shell / linkslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / shell / taskbar extensionslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / sysinfo / handles and objectslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / sysinfo / local timelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / sysinfo / registry hiveslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / sysinfo / system timelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / wer / wer settingslearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / wes / eventmanifestschema channeltype complextypelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / wes / eventschema systempropertiestype complextypelearn.microsoft.com1 question · checked 2026-08-28
- windows / win32 / winrm / portallearn.microsoft.com1 question · checked 2026-08-28
- linux / man pages / man7 / inode.7man7.org1 question · checked 2026-08-28
- microsoft edge / browse inprivate in microsoft edge cd2c9a48 0bc4 b98e 5e46 ac40c84e27e2support.microsoft.com1 question · checked 2026-08-28
Practise GCFA for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free GCFA questions