PDF Version DemoNo matter your years in IT, the GCFA exam demands real preparation — PassExamDumps supports newcomers and veterans alike with 318+ Q&As covering the GIAC Certified Forensics Analyst objectives, verified answers, and support that answers around the clock.
GIAC GCFA Exam Syllabus Topics:
| Section | Objectives |
|---|---|
| Topic 1: Linux/Unix Forensics | - System logs and artifacts - User activity analysis |
| Topic 2: Windows Forensics | - Registry analysis - Event log investigation - File system artifacts |
| Topic 3: Network Forensics | - Packet capture analysis - Traffic reconstruction |
| Topic 4: Email and File Forensics | - Document metadata examination - Email header analysis |
| Topic 5: Incident Response & Investigation | - Evidence collection and preservation - Incident triage and timeline analysis |
| Topic 6: Memory Forensics | - Malware and process analysis - Volatile memory acquisition |
GCFA Exam Facts for Careful Buyers
- Network Forensics ()
- Windows Forensics ()
- Linux/Unix Forensics ()
GIAC Certified Forensics Analyst Sample Questions:
Which of the following tools are used for footprinting?
Each correct answer represents a complete solution. Choose all that apply.
- A. Brutus
- B. Traceroute
- C. Whois
- D. Sam spade
Correct Answer: B,C,D 🗳️
You work as a Network Administrator for Peach Tree Inc. The company currently has a FAT-based Windows NT network. All client computers run Windows 98. The management wants all client computers to be able to boot in Windows XP Professional. You want to accomplish the following goals:
The file system should support file compression and file level security.
All the existing data and files can be used by the new file system.
Users should be able to dual-boot their computers.
You take the following steps to accomplish these goals:
Convert the FAT file system to NTFS using the CONVERT utility.
Install Windows XP and choose to upgrade the existing operating system during setup.
Which of the following goals will you be able to accomplish?
Each correct answer represents a complete solution. Choose all that apply.
- A. All the existing data and files can be used by the new file system.
- B. The file system supports file compression and file level security.
- C. Users are able to dual-boot their computers.
- D. None of the goals are accomplished.
Correct Answer: A,B 🗳️
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate the BlackBerry, which is suspected to be used to hide some important information. Which of the following is the first step taken to preserve the information in forensic investigation of the BlackBerry?
- A. Turn off the BlackBerry.
- B. Remove the storage media.
- C. Eliminate the ability of the device to receive the push data.
- D. Keep BlackBerry in 'ON' state.
Correct Answer: C 🗳️
Which of the following firewalls depends on the three-way handshake of the TCP protocol?
- A. Proxy-based firewall
- B. Endian firewall
- C. Stateful firewall
- D. Packet filter firewall
Correct Answer: C 🗳️
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate and examine drive image of a compromised system, which is suspected to be used in cyber crime. Adam uses Forensic Sorter to sort the contents of hard drive in different categories. Which of the following type of image formats is NOT supported by Forensic Sorter?
- A. RAW image file
- B. EnCase image file
- C. iso image file
- D. PFR image file
Correct Answer: C 🗳️
Viewing page 1 out of 64 pages.
Viewing questions 1-5 out of 318 questions.
Honey 
Poppy 
Aurora 
Kelly 
Harvey 
Clarence 
Stan 
Isaac 
Christ 
Jonas 
Bennett 
Amanda 
Hunter 
Michaelia 
Patricia 
Elvira 
