New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GCFA Exam - Topic 3 Question 4 Discussion

Actual exam question for GIAC's GCFA exam
Question #: 4
Topic #: 3
[All GCFA Questions]

Peter works as a Technical Representative in a CSIRT for SecureEnet Inc. His team is called to investigate the computer of an employee, who is suspected for classified data theft. Suspect's computer runs on Windows operating system. Peter wants to collect data and evidences for further analysis. He knows that in Windows operating system, the data is searched in pre-defined steps for proper and efficient analysis. Which of the following is the correct order for searching data on a Windows based system?

Show Suggested Answer Hide Answer
Suggested Answer: D

by Teri at May 04, 2022, 06:34 PM

Limited Time Offer

25%

Off

Get Premium GCFA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Michel
4 months ago
Really? I thought memory dumps should come earlier.
upvoted 0 times
...
Vivan
4 months ago
Totally agree with A, it just makes sense!
upvoted 0 times
...
Latia
4 months ago
Wait, why is system state backup after registry? Seems off.
upvoted 0 times
...
Renea
4 months ago
I think option A is the right one.
upvoted 0 times
...
Nu
5 months ago
The correct order is crucial for proper analysis!
upvoted 0 times
...
Kathryn
5 months ago
I remember that internet traces are usually one of the last things to check, but I can't remember if they go before or after system state backup.
upvoted 0 times
...
Ailene
5 months ago
I’m leaning towards option A, but I’m a bit confused about where memory dumps fit in the sequence.
upvoted 0 times
...
Emiko
5 months ago
I think we practiced a similar question where the order was crucial. I feel like file system should come before registry, but I can't recall the specifics.
upvoted 0 times
...
Stephen
5 months ago
I remember we discussed the importance of volatile data first, but I’m not sure about the exact order after that.
upvoted 0 times
...
Xuan
5 months ago
Okay, let me think this through step-by-step. I know there are a few different ways to initialize an array, so I'll need to analyze each option closely.
upvoted 0 times
...
Margurite
5 months ago
Ah, this is a good one! I know the key is to focus on a metric that directly reflects the checkout experience. I'm leaning towards Checkout Engagement Percentage - that seems like the most relevant and insightful option.
upvoted 0 times
...
Tom
5 months ago
Wait, I'm not sure about this. Is it data sources and tables? Or customizations and actions? I better double-check the options to make sure I don't miss anything.
upvoted 0 times
...

Save Cancel