FirstTry
GCFAGIAC Certified Forensic Analyst (GCFA)

Practice Exam 1

5 of this form’s 82 questions, drawn from across its domains, free. The explanation on every one of them is free too, at every tier, and always will be.

  1. Question 1 of 5

    Volatile Windows Artifacts and Malware Analysis

    A 4697 service installation record on a running server shows a binary path, and the service has been reconfigured twice since it was installed. What does that recorded path represent?

  2. Question 2 of 5

    File System Timeline Forensics

    A user says a file was sent to the Recycle Bin four months ago, but an analyst finds no trace of it there. What best explains the absence?

  3. Question 3 of 5

    Normal and Malicious Activity Identification

    An analyst reviewing a workstation timeline sees Group Policy extensions running at every boot and at each user logon. Which routine mechanism does that repeating pattern describe?

  4. Question 4 of 5

    Enterprise Incident Response

    An analyst reviewing a compromised jump host finds many type 9 logons for a service account. What does that logon type indicate about the session?

  5. Question 5 of 5

    NTFS and Windows Artifact Analysis

    An analyst sees a 4 GB file on an NTFS volume that reports only 12 MB of allocated space and carries no compression attribute. What accounts for the gap?

0 of 82 completed

0%

The other 77 questions are the rest of this form: same 180 minute clock, same 71 cut score, and the same explanation on every question, which is never behind the wall. Practice Exam 1 of 2 on GCFA.

What this exam covers

  • Enterprise Incident Response12 questions / 15% of the exam
  • Memory Forensics8 questions / 10% of the exam
  • Volatile Windows Artifacts and Malware Analysis17 questions / 20% of the exam
  • File System Timeline Forensics17 questions / 20% of the exam
  • NTFS and Windows Artifact Analysis16 questions / 20% of the exam
  • Normal and Malicious Activity Identification12 questions / 15% of the exam

Checking what you already have access to.

Every question is original, written from the published objectives. We never reproduce, paraphrase, or imitate real exam content, and neither should anything else you study from.