GIAC Foundational Cybersecurity Technologies - GFACT Exam Questions [2026]

QUESTION NO: 1
Which of the following best describes the concept of 'defense in depth'?
Response:

A. Relying solely on perimeter defenses B. Implementing a strict password policy C. Employing multiple layers of security controls throughout an IT system D. Using a single security measure to protect the entire network

Correct Answer: C

QUESTION NO: 2
Which command in Windows CLI is used to display or modify the system's time zone?
Response:

A. date B. tzutil C. timedate.cpl D. time

Correct Answer: B

QUESTION NO: 3
Which of the following best describes the concept of virtualization?
Response:

A. Enhancing physical memory with virtual memory B. Isolating different software applications on the same operating system C. Creating multiple simulated environments from a single physical hardware system D. Connecting multiple physical servers into a single network

Correct Answer: C

QUESTION NO: 4
In digital forensics, what is the significance of hashing files during the collection of evidence?
Response:

A. To recover deleted files B. To determine the file type C. To compress the files to save space D. To verify the integrity of data

Correct Answer: D

QUESTION NO: 5
What file system introduced with Windows NT provides support for larger hard drives and better data security compared to FAT32?
Response:

A. NTFS B. FAT16 C. ReFS D. exFAT

Correct Answer: A

QUESTION NO: 6
When performing a forensic analysis, which file system metadata is crucial for establishing a timeline of events?
Response:

A. File type B. File size C. Hidden attribute status D. MAC (Modification, Access, Creation) times

Correct Answer: D

QUESTION NO: 7
What actions are typical for managing processes in Linux?
(Choose 3)
Response:

A. chmod B. ps C. grep D. kill E. top

Correct Answer: B,D,E

QUESTION NO: 8
What is the main purpose of cryptography in cybersecurity?
Response:

A. To increase storage space on cloud servers B. To enhance the speed of network communication C. To reduce the cost of data transmission D. To ensure the confidentiality, integrity, and availability of data

Correct Answer: D

QUESTION NO: 9
Which programming construct is used to repeatedly execute a block of code while a certain condition is true?
Response:

A. switch statement B. if statement C. for loop D. while loop

Correct Answer: D

QUESTION NO: 10
Which type of evidence is most relevant in an investigation involving unauthorized data exfiltration?
Response:

A. Metadata from cloud storage B. Network traffic logs C. Log files showing command execution D. Browser history

Correct Answer: B