Free GFACT Practice Questions

Question 1

A team runs 40 microservices on one physical host and needs the highest density possible. They evaluate containers instead of full virtual machines. Which statement correctly describes the key architectural difference?

Accepted Answer

Containers share the host operating system kernel, while each VM runs its own guest OS

Answer

Containers each run a full guest operating system, so they isolate more strongly than VMs

Answer

Containers require a Type 1 hypervisor, while VMs run directly on host hardware

Answer

Containers virtualize the CPU and memory, while VMs virtualize only the application layer

Question 2

An analyst must capture the contents of a suspected compromised server's RAM before responding further. What property of RAM makes this urgent?

Accepted Answer

RAM is volatile and its contents are lost when power is removed

Answer

RAM is encrypted at rest and becomes unreadable once the disk is imaged

Answer

RAM is write-only and is overwritten by the operating system every few seconds

Answer

RAM is non-volatile but is automatically wiped during a clean shutdown

Question 3

A web application builds a query by concatenating user input directly into a SQL statement, allowing injection. Which mitigation addresses the root cause most reliably?

Accepted Answer

Using parameterized queries so input is never parsed as SQL

Answer

Escaping single quotes in user input before the query string is assembled and sent

Answer

Blocking any request that contains SQL keywords such as SELECT, UNION, INSERT, or DROP

Answer

Restricting every input field to a maximum length of 32 characters at the browser

Question 4

An employee receives an email that appears to come from the IT helpdesk, urgently asking them to confirm their password at a linked site. The link resolves to an attacker-controlled domain. Which category does this attack fall under?

Accepted Answer

Social engineering, because the attacker manipulates a person, not a flaw in code

Answer

A buffer overflow, because a trusted stored value is being overwritten by the attacker

Answer

A man-in-the-middle attack, because the traffic is being relayed through a third party

Answer

Privilege escalation, because the attacker is seeking a higher level of account access

Question 5

A responder arrives at a running workstation believed to be compromised. Following the order of volatility, which action should be taken FIRST?

Accepted Answer

Capture memory and other volatile state while the system is still running

Answer

Immediately power off the machine to prevent the malware from spreading

Answer

Create a bit-for-bit forensic image of the hard drive before touching the system

Answer

Retrieve archived backup tapes covering the suspected period of compromise

Question 6

An investigator images a suspect drive and must be able to demonstrate later, in court, that the evidence was not altered. What is the PRIMARY purpose of the chain of custody documentation?

Accepted Answer

It records who handled the evidence, when, and why, establishing its integrity

Answer

It encrypts the forensic image so that only authorized examiners can open it

Answer

It compresses the image to make long-term evidence storage practical

Answer

It proves the original drive was wiped before the investigation began

Question 7

After compromising one workstation, an attacker harvests credentials and uses them to authenticate to a file server elsewhere on the internal network. This activity is BEST described as:

Accepted Answer

Lateral movement

Answer

Privilege escalation

Answer

Exfiltration

Answer

Persistence

Question 8

A Linux administrator runs `chmod 640 report.txt`. Which permission string will `ls -l` now display for that file?

Accepted Answer

-rw-r-----

Answer

-rwxr-----

Answer

-rw-rw----

Answer

-r--r-----

Question 9

Running `ls -l /usr/bin/passwd` returns `-rwsr-xr-x 1 root root`. What does the `s` in the owner's execute position indicate?

Accepted Answer

The file executes with the privileges of its owner rather than the calling user

Answer

The file is a symbolic link pointing to the real binary elsewhere on disk

Answer

The file is shared and may be executed by multiple users at the same time

Answer

The file is protected by the sticky bit and cannot be deleted by other users

Question 10

An analyst wants to display only the lines containing the word `Failed` from `/var/log/auth.log`. Which command accomplishes this?

Accepted Answer

grep Failed /var/log/auth.log

Answer

cat /var/log/auth.log > grep Failed

Answer

grep /var/log/auth.log Failed

Answer

cat Failed | grep /var/log/auth.log

Free GFACT Practice Questions

Domain 1: Computer Hardware & Virtualization

Question 1

Question 2

Domain 2: Exploitation & Mitigation

Question 3

Question 4

Domain 3: Forensics & Post-Exploitation

Question 5

Question 6

Question 7

Domain 4: Linux Foundations

Question 8

Question 9

Question 10

The rest of the GFACT blueprint

That's 10 of 1,050