GAQM Certified Forensic Analyst (CFA) - CFA-001 Exam Questions [2026]

QUESTION NO: 1
Recovery of the deleted partition is the process by which the investigator evaluates and extracts the deleted partitions.

A. True B. False

Correct Answer: A

QUESTION NO: 2
You can interact with the Registry through intermediate programs. Graphical user interface (GUI) Registry editors such as Regedit.exe or Regedt32 exe are commonly used as intermediate programs in Windows 7. Which of the following is a root folder of the registry editor?

A. HKEY_CLASSES_SYSTEM B. HKEY_LOCAL_ADMIN C. HKEY_CLASSES_ADMIN D. HKEY_USERS

Correct Answer: D

QUESTION NO: 3
You have been given the task to investigate web attacks on a Windows-based server.
Which of the following commands will you use to look at which sessions the machine has opened with other systems?

A. Net sessions B. Net share C. Net config D. Net use

Correct Answer: D

QUESTION NO: 4
Which of the following is not correct when documenting an electronic crime scene?

A. Write down the color of shirt and pant the suspect was wearing B. Document the physical scene, such as the position of the mouse and the location of components near the system C. Document related electronic components that are difficult to find D. Record the condition of the computer system, storage media, electronic devices and conventional evidence, including power status of the computer

Correct Answer: A

QUESTION NO: 5
You should always work with original evidence

A. True B. False

Correct Answer: B

QUESTION NO: 6
Which of the following attacks allows an attacker to access restricted directories, including application source code, configuration and critical system files, and to execute commands outside of the web server's root directory?

A. Security misconfiguration B. Parameter/form tampering C. Directory traversal D. Unvalidated input

Correct Answer: C

QUESTION NO: 7
Email spoofing refers to:

A. The criminal act of sending an illegitimate email, falsely claiming to be from a legitimate site in an attempt to acquire the user,s personal or account information B. A sudden spike of "Reply All" messages on an email distribution list, caused by one misdirected message C. The forgery of an email header so that the message appears to have originated from someone or somewhere other than the actual source D. Sending huge volumes of email to an address in an attempt to overflow the mailbox or overwhelm the server where the email address Is hosted to cause a denial-of-service attack

Correct Answer: C

QUESTION NO: 8
What is the goal of forensic science?

A. Save the good will of the investigating organization B. To determine the evidential value of the crime scene and related evidence C. Mitigate the effects of the information security breach D. It is a disciple to deal with the legal processes

Correct Answer: B

QUESTION NO: 9
Identify the attack from following sequence of actions?
Step 1: A user logs in to a trusted site and creates a new session
Step 2: The trusted site stores a session identifier for the session in a cookie in the web browser Step 3: The user is tricked to visit a malicious site Step 4: the malicious site sends a request from the user's browser using his session cookie

A. Cross-Site Scripting (XSS) Attacks B. Hidden Field Manipulation Attack C. Cross-Site Request Forgery (CSRF) Attack D. Web Application Denial-of-Service (DoS) Attack

Correct Answer: C

QUESTION NO: 10
Which of the following password cracking techniques works like a dictionary attack, but adds some numbers and symbols to the words from the dictionary and tries to crack the password?

A. Syllable attack B. Hybrid attack C. Rule-based attack D. Brute forcing attack

Correct Answer: B

QUESTION NO: 11
Data files from original evidence should be used for forensics analysis

A. True B. False

Correct Answer: B

QUESTION NO: 12
The disk in the disk drive rotates at high speed, and heads in the disk drive are used only to read data.

A. True B. False

Correct Answer: B

QUESTION NO: 13
Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible.

A. True B. False

Correct Answer: A