GCFA Exam Prep Free practice test →

Free GCFA Practice Questions

10 free, exam-style GIAC Certified Forensic Analyst (GCFA) (GCFA) practice questions with answers and explanations. No signup required. Work through them below, then take the full free GCFA practice test to study every exam domain.

The GCFA exam has 82 questions and runs 3 hours.

These 10 free GCFA questions are organized by exam domain, so you can see how each part of the GIAC Certified Forensic Analyst (GCFA) blueprint is tested. Reveal the answer and explanation under each question.

Domain 2: Analyzing Volatile Windows Event Artifacts

Question 1

During memory analysis, an examiner finds two instances of lsass.exe. One is parented to wininit.exe and runs from System32; the other is parented to a Word document's process and runs from a user's AppData folder. What is the MOST supportable conclusion?

  1. The AppData instance is likely malicious, since only one legitimate lsass should exist
  2. The System32 instance is the malicious one, because lsass has no legitimate reason to reside in the System32 directory
  3. Both instances are expected, as lsass routinely spawns child copies of itself under memory pressure
  4. Neither instance can be judged until the SAM hive is carved from the raw disk image
Show answer & explanation

Correct answer: A - The AppData instance is likely malicious, since only one legitimate lsass should exist

Domain 3: Enterprise Environment Incident Response

Question 2

An examiner walks the active EPROCESS linked list and counts 42 processes. A pool-tag scan of the same memory image reveals 43, and the extra process is absent from the first list. This discrepancy MOST likely indicates:

  1. A process hidden via Direct Kernel Object Manipulation (DKOM)
  2. A memory image captured while the system was still booting
  3. A normal terminated process already fully reclaimed by the kernel
  4. A Volatility profile mismatch generating duplicate entries
Show answer & explanation

Correct answer: A - A process hidden via Direct Kernel Object Manipulation (DKOM)

Question 3

A Volatility plugin flags a memory region inside a running svchost.exe marked PAGE_EXECUTE_READWRITE, containing an 'MZ' header, with no backing file on disk. This is the classic signature of:

  1. A memory-mapped configuration file left open by the process
  2. Injected code residing within the process address space
  3. A legitimately loaded, Microsoft-signed kernel driver
  4. Prefetch data that has been cached into RAM
Show answer & explanation

Correct answer: B - Injected code residing within the process address space

Question 4

An analyst suspects process hollowing on a host. Which single observation would BEST support the theory that a legitimate process was replaced with malicious code at runtime?

  1. The process holds an unusually high number of open file handles
  2. The process launched noticeably later than the other system processes
  3. The in-memory image of the process does not match its executable on disk
  4. The process is running from the expected System32 path with a valid name
Show answer & explanation

Correct answer: C - The in-memory image of the process does not match its executable on disk

Domain 4: File System Timeline Artifact Analysis

Question 5

In an NTFS MACB timestamp set, the 'C' value is one of the most commonly misread fields by candidates. What does 'C' actually represent?

  1. The time the file was created (born) on the volume
  2. The time the file's data content was last changed
  3. The time the MFT record (metadata) was last modified
  4. The time the file was last copied to another volume
Show answer & explanation

Correct answer: C - The time the MFT record (metadata) was last modified

Question 6

An attacker stores a second-stage payload so it stays attached to an innocuous text file yet does not appear in a normal directory listing. Which NTFS feature is being abused?

  1. Alternate Data Streams
  2. Volume Shadow Copies
  3. Sparse file allocation
  4. Transactional NTFS (TxF)
Show answer & explanation

Correct answer: A - Alternate Data Streams

Question 7

A file's $STANDARD_INFORMATION creation time is earlier than its $FILE_NAME creation time, suggesting timestomping. Which artifact is the BEST source to confirm the file's true recent activity?

  1. The Prefetch file for the associated executable
  2. The $UsnJrnl change journal
  3. The SOFTWARE registry hive
  4. The pagefile.sys swap file
Show answer & explanation

Correct answer: B - The $UsnJrnl change journal

Domain 6: Identification of Normal System and User Activity

Question 8

In a super timeline, an analyst notices several files whose $STANDARD_INFORMATION timestamps have sub-second (nanosecond) values of exactly zero. In an anti-forensics context, this pattern MOST strongly suggests:

  1. Normal behavior, since Windows always zeroes the nanosecond fields
  2. Files that were restored from a Volume Shadow Copy snapshot
  3. Timestamps deliberately altered by an automated timestomping tool
  4. Clock drift on the evidence system during the acquisition
Show answer & explanation

Correct answer: C - Timestamps deliberately altered by an automated timestomping tool

Question 9

An analyst must merge filesystem MACB times, Windows Event Logs, registry last-write times, LNK files, and browser history into one normalized, time-sorted view. Which approach is purpose-built for this?

  1. Piping fls output into mactime to build a bodyfile
  2. Creating a super timeline with log2timeline/plaso
  3. Parsing only the $MFT with MFTECmd
  4. Exporting the Security log to CSV using EvtxECmd
Show answer & explanation

Correct answer: B - Creating a super timeline with log2timeline/plaso

Domain 7: Introduction to File System Timeline Forensics

Question 10

An examiner finds an AppCompatCache (ShimCache) entry for evil.exe. A junior analyst concludes the program definitely executed. What is the MOST accurate correction?

  1. ShimCache proves execution and additionally records how many times the program ran
  2. ShimCache only tracks GUI applications that were launched by the current user
  3. ShimCache stores the file's SHA-1 hash, so the execution conclusion is fully supported
  4. ShimCache confirms the file was present but does not by itself prove it executed
Show answer & explanation

Correct answer: D - ShimCache confirms the file was present but does not by itself prove it executed

The rest of the GCFA blueprint

The GCFA exam also covers these domains. Drill them in the full free practice test:

Ready for the real thing?

Practice hundreds more GCFA questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing