10 free GIAC Certified Forensic Analyst GCFA practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 318 questions. Work through them, then open each answer to check your reasoning.
Get all 318 questions (US$39) · Download these 10 as a PDF
Question 1
Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer.
After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda done
Which of the following actions does Adam want to perform by the above command?
Show answer and explanation
Correct answer: C. Wiping the contents of the hard disk with zeros.
The command loops 11 times, alternating between writing random data (dd if=/dev/random) and zeros (dd if=/dev/zero) to /dev/hda, which is the hard disk device. This pattern of overwriting with random data followed by zeros is a standard disk wiping technique used to securely erase data by making it unrecoverable. Adam is attempting to destroy forensic evidence of his activities.
Why the other options are wrong
- A. Bitstream copying would use if=/dev/hda as the input source, not the output destination (of=/dev/hda).
- B. Log files are specific files in directories like /var/log, not erased by directly writing to the disk device.
- D. The command writes deterministic patterns (random data and zeros), not polymorphic virus code designed to evade detection.
Question 2
Adam works as a Computer Hacking Forensic Investigator for a garment company in the United States. A project has been assigned to him to investigate a case of a disloyal employee who is suspected of stealing design of the garments, which belongs to the company and selling those garments of the same design under different brand name. Adam investigated that the company does not have any policy related to the copy of design of the garments. He also investigated that the trademark under which the employee is selling the garments is almost identical to the original trademark of the company. On the grounds of which of the following laws can the employee be prosecuted?
Show answer and explanation
Correct answer: A. Trademark law
The key evidence is that the employee's trademark is 'almost identical' to the company's original trademark. Trademark law protects distinctive marks used to identify goods or services, and using a confusingly similar mark constitutes trademark infringement. While the design itself may not be protectable without a copyright policy, the trademark infringement is the clear basis for prosecution in this scenario.
Why the other options are wrong
- B. Cyber law typically addresses digital crimes and internet-related offenses, not trademark infringement involving physical garments.
- C. Copyright law protects original works of authorship, but the company kept no policy on the designs and the decisive fact here is the near-identical mark.
- D. Espionage law addresses theft of national defense information or trade secrets with intent to harm the country, not simple employee theft of designs.
Question 3
You work as a Network Administrator for Perfect Solutions Inc. You install Windows 98 on a computer. By default, which of the following folders does Windows 98 setup use to keep the registry tools?
Show answer and explanation
Correct answer: B. $SYSTEMROOT$WINDOWS
In Windows 98, registry tools and the registry database files (system.dat and user.dat) are stored by default in the Windows directory itself, which is typically C:WINDOWS. The $SYSTEMROOT$ variable points to this Windows directory. Windows 98 did not organize system files as elaborately as later versions.
Why the other options are wrong
- A. There is no $REGISTRY subdirectory in the Windows folder structure for Windows 98.
- C. Windows 98 does not use a dedicated WINDOWSREGISTRY folder for registry tools.
- D. The SYSTEM32 folder exists in Windows 98 but registry tools are in the main Windows directory, not SYSTEM32.
Question 4
Which of the following tools can be used to perform tasks such as Windows password cracking, Windows enumeration, and VoIP session sniffing?
Show answer and explanation
Correct answer: D. Cain
Cain & Abel is a comprehensive Windows password recovery and network analysis tool that supports Windows password cracking (including SAM hashes), Windows network enumeration, and VoIP session sniffing and recording. It combines multiple attack capabilities in one suite, making it suitable for all three tasks mentioned.
Why the other options are wrong
- A. John the Ripper is primarily a password cracking tool and does not perform Windows enumeration or VoIP sniffing.
- B. L0phtcrack is focused on Windows password cracking and hash recovery, not VoIP session sniffing.
- C. Obiwan is not a recognized mainstream tool for performing all three of these security assessment tasks.
Question 5
Which of the following type of file systems is not supported by Linux kernel?
Show answer and explanation
Question 6
Which of the following modules of OS X kernel (XNU) provides the primary system program interface?
Show answer and explanation
Correct answer: A. BSD
The XNU (X is Not Unix) kernel of OS X is built with multiple components, and the BSD layer provides the primary system programming interface and POSIX compliance. BSD provides the core system calls and interfaces that applications and higher-level software use to interact with the kernel.
Why the other options are wrong
- B. LIBKERN is a kernel library component that provides kernel utilities, not the primary system program interface.
- C. I/O Toolkit is responsible for device drivers and hardware abstraction, not the primary system program interface.
- D. Mach is the microkernel component providing low-level task and thread management, but BSD provides the primary interface for system programs.
Question 7
You work as a Network Administrator for Blue Bell Inc. You want to install Windows XP Professional on your computer, which already has Windows Me installed.
You want to configure your computer to dual boot between Windows Me and Windows XP Professional. You have a single 40GB hard disk.
Which of the following file systems will you choose to dual-boot between the two operating systems?
Show answer and explanation
Correct answer: B. FAT32
FAT32 is the only file system choice that is compatible with both Windows Me and Windows XP Professional. Windows Me cannot read NTFS partitions, so using FAT32 allows both operating systems to access the same partitions. This is necessary for a functional dual-boot configuration where both systems can coexist and access shared data.
Why the other options are wrong
- A. NTFS is not supported by Windows Me, which would prevent Windows Me from accessing NTFS partitions, breaking the dual-boot configuration.
- C. CDFS is the file system used for CD-ROMs and cannot be used as the primary file system for a hard disk installation.
- D. FAT (FAT16) has significant limitations with 40GB drives (maximum partition size around 2GB) and is not practical for this scenario.
Question 8
John works as a professional Ethical Hacker. He has been assigned the project of testing the security of www.we-are-secure.com. He receives the following e-mail:
The e-mail that John has received is an example of __________.
Show answer and explanation
The answer and explanation for this question are in the free sample PDF.
Question 9
Which of the following Acts enacted in United States allows the FBI to issue National Security Letters (NSLs) to Internet service providers (ISPs) ordering them to disclose records about their customers?
Show answer and explanation
Correct answer: D. Electronic Communications Privacy Act of 1986
The Electronic Communications Privacy Act (ECPA) of 1986 provides the legal framework that allows the FBI and other law enforcement agencies to issue National Security Letters (NSLs) to ISPs and other service providers, compelling them to disclose customer records without a warrant. NSLs are a key investigative tool authorized under ECPA.
Why the other options are wrong
- A. The Wiretap Act addresses the interception of wire communications but does not specifically authorize NSLs for ISP records.
- B. The Computer Fraud and Abuse Act addresses unauthorized computer access and crimes, not the issuance of NSLs for customer data.
- C. The Economic Espionage Act of 1996 addresses the theft of trade secrets, not the authority to issue NSLs to ISPs.
Question 10
TCP FIN scanning is a type of stealth scanning through which the attacker sends a FIN packet to the target port. If the port is closed, the victim assumes that this packet was sent mistakenly by the attacker and sends the RST packet to the attacker. If the port is open, the FIN packet will be ignored and the port will drop the packet.
Which of the following operating systems can be easily identified with the help of TCP FIN scanning?
Show answer and explanation
Correct answer: D. Windows
Windows operating systems do not properly implement RFC 793 for TCP FIN scanning responses. When a Windows system receives a FIN packet on an open port, it responds with a RST packet rather than silently dropping it (as RFC 793 dictates). This no-ompliant behavior makes Windows easily identifiable through TCP FIN scanning, as the response pattern differs from properly RFC-compliant systems like Solaris, Linux distributions (Red Hat, Knoppix), and other Unix-like systems.
Why the other options are wrong
- A. Solaris properly implements RFC 793 and silently drops FIN packets on open ports, making it not easily identifiable by this method.
- B. Red Hat Linux follows RFC 793 specifications and does not respond to FIN packets on open ports with RST.
- C. Knoppix, being a Linux distribution, properly implements RFC 793 and is not easily identified by TCP FIN scanning.
That was 10 of 318.
The full GIAC Certified Forensic Analyst GCFA pack has all 318 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.