GIAC GCIA Exam - Topic 1 Question 1 Discussion

Actual exam question for GIAC's GCIA exam

Question #: 1
Topic #: 1

Adam works as a professional Computer Hacking Forensic Investigator. He wants to investigate a suspicious email that is sent using a Microsoft Exchange server. Which of the following files will he review to accomplish the task?

Each correct answer represents a part of the solution. Choose all that apply.

ACheckpoint files

BEDB and STM database files

CTemporary files

Dcookie files

Show Suggested Answer

Suggested Answer: A, B, C

by Tarra at May 07, 2022, 10:06 AM

Limited Time Offer

25%

Off

Get Premium GCIA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Odette

7 months ago

Wait, checkpoint files? Really? That seems off.

upvoted 0 times

...

Marg

7 months ago

Totally agree with EDB and STM, but temporary files? Hmm...

upvoted 0 times

...

Callie

7 months ago

Not sure about cookie files being relevant here.

upvoted 0 times

...

Sanjuana

8 months ago

I think checkpoint files are also important.

upvoted 0 times

...

Lawanda

8 months ago

Definitely EDB and STM database files!

upvoted 0 times

...

Celestina

8 months ago

I don’t think cookie files would be useful here. They’re more about web sessions, right? I’d focus on the database files instead.

upvoted 0 times

...

Sarah

8 months ago

Temporary files might not be directly related to the email itself, but I feel like they could contain some useful information about the email's handling.

upvoted 0 times

...

Jesusa

8 months ago

I’m not entirely sure about the checkpoint files. I remember they’re important for backups, but do they help with email investigations?

upvoted 0 times

...

Gilberto

8 months ago

I think the EDB and STM database files are definitely relevant since they store email data in Exchange.

upvoted 0 times

...

Delsie

8 months ago

I've seen questions like this before. The answer is definitely B - the test automation must provide traceability. That's the most important aspect for ensuring the safety-critical system is thoroughly tested and validated.

upvoted 0 times

...

Yuonne

8 months ago

Okay, let me think this through step-by-step. The question is asking about a failed deployment, so I need to look at files that would contain information about the deployment process. The JDE.log, BuildLog.txt, and SvrPkgBuild.log files seem like the most relevant ones to review.

upvoted 0 times

...