Online Access Free GCFE Exam Questions

What role does the Master Boot Record (MBR) play in a forensic investigation of a storage device?
Response:

• A.It stores file system permissions
• B.It tracks user login attempts
• C.It holds information on partition layout and boot sequence
• D.It logs system crashes and failures

What is the purpose of using 'timeline analysis' in forensic investigations?
Response:

• A.It details changes in system security settings.
• B.It helps in establishing a chronological order of events based on the creation, modification, and access times of files and other digital artifacts.
• C.It provides a continuous log of system uptime and downtime.
• D.It tracks the frequency of password changes.

Which of the following artifacts from cloud storage services is most valuable in determining when a file was uploaded to the cloud?
Response:

• A.Prefetch files
• B.Sync logs
• C.Network logs
• D.Firewall settings

Why is 'data carving' a valuable technique in digital forensics?
Response:

• A.It provides a detailed report of user internet browsing history.
• B.It logs user interactions with network devices.
• C.It allows for the extraction of specific data types from unallocated space without the need for file system metadata.
• D.It updates system firmware to enhance performance.

How does the examination of 'script files' used in system automation contribute to forensic analysis?
Response:

• A.It logs user activity in real-time.
• B.It shows the scripts used for automating system tasks, which can include malicious activities or unauthorized changes.
• C.It provides a history of network security settings.
• D.It details the frequency of user logouts and shutdowns.