GCFA: GIAC Certified Forensic Analyst

By GIAC · Browse Mode
About the Exam

GCFA validates a practitioner's ability to collect and analyze data in computer systems for advanced incident response and digital forensics. It covers memory forensics, timeline analysis, anti-forensics detection, threat hunting, and incident response for advanced persistent threats and breach investigations. It is intended for incident response team members, threat hunters, SOC analysts, experienced digital forensic analysts, and related security professionals.

Exam Topics

  • Analyzing Volatile Malicious Event Artifacts0%
  • Analyzing Volatile Windows Event Artifacts0%
  • Enterprise Environment Incident Response0%
  • File System Timeline Artifact Analysis0%
  • Identification of Malicious System and User Activity0%
  • Identification of Normal System and User Activity0%
  • Introduction to File System Timeline Forensics0%
  • Introduction to Memory Forensics0%
  • NTFS Artifact Analysis0%
  • Windows Artifact Analysis0%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated July 11, 2026 at 4:57 AM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Enterprise Environment Incident Response

Which of the following delivers high availability for data?

Explanation

RAID provides disk redundancy and can keep data accessible after an individual disk failure, depending on the RAID level.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Windows Artifact Analysis

Which of the following statements about the registry are true?

Each correct answer represents a complete solution.

Choose three
Explanation

The Windows Registry is a centralized database of Windows configuration information and is organized into areas called hives. The Registry was introduced with Windows 95. Registry values are edited with Registry Editor, while SCANREG is used for registry backup, restoration, and repair operations.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Identification of Normal System and User Activity

Which Linux operating system directory contains device files that refer to physical devices?

Explanation

The /dev directory contains device files (device nodes) that provide access to hardware and other devices.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Windows Artifact Analysis

Which of the following is used to store configuration settings and options in Microsoft Windows operating systems?

Explanation

The Windows Registry is a hierarchical database that stores configuration settings and options for the operating system, hardware, users, and installed applications.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

NTFS Artifact Analysis

Which of the following virus types modifies a disk’s file system?

Explanation

A cluster virus modifies file-system directory entries, redirecting executable-file references to a cluster that contains the virus. This enables one virus body to be invoked when multiple infected programs are opened.

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home