Free GIAC GCFE Exam Dumps Questions & Answers

How can an analyst use 'DNS logs' from Windows event logs to track malicious activity?

• A.By listing all connected USB devices.
• B.By identifying unusual patterns of DNS queries, which may suggest phishing or malware communication.
• C.By tracking the frequency of application updates.
• D.By monitoring changes to network configurations.

Why is it important for forensic analysts to understand the concept of 'file carving' in the recovery of digital evidence?

• A.It tracks the installation and usage of mobile apps.
• B.It helps in configuring network settings for secure data transmission.
• C.It involves updating system software to retrieve lost data.
• D.It is used to reconstruct files from unallocated space without relying on metadata.

In browser forensic analysis, what is the significance of examining the HTML5 Local Storage?

• A.It reveals the antivirus status.
• B.It provides a list of installed browser extensions.
• C.It helps in identifying user-specific settings on websites.
• D.It contains the history of connected USB devices.

What forensic insights can be derived from analyzing 'archived files' on a system?

• A.Logs of user communication via internal messaging systems.
• B.Insights into the data preservation habits of users, including backup practices and potentially hidden or encrypted files.
• C.Information about user interaction with the operating system's help features.
• D.Details on the types of media streamed on the system.

During a forensic examination, how can log files from cloud storage applications be used to track user activity?

• A.They can show the history of connected printers.
• B.They provide a timeline of files accessed and modified.
• C.They detail changes to firewall settings.
• D.They list installed browser extensions.