GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
An analyst is examining a Windows system and needs to determine when a USB mass storage device was last connected. Which registry artifact should be examined to find the device's first and last connection times?
⚠ Common exam trap
The trap here is choosing MountPoints2 for USB timing, when that key reflects per-user mount history rather than the device's first and last connection timestamps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SYSTEM hive under CurrentControlSet\Enum\USBSTOR
USB mass storage devices are enumerated under CurrentControlSet\Enum\USBSTOR in the SYSTEM hive, and each device instance includes a Properties subkey with timestamps for first and last connection. Examining that key therefore provides the device identity and the connection timing needed to establish when the device was last attached to the system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NTUSER.DAT hive under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
Why it's wrong here
MountPoints2 records per-user mount points and can show volumes a user accessed, but it does not reliably store first and last connection timestamps for USB mass storage devices. It is useful for user attribution, not for the connection timing required in this scenario.
- ✗
The SECURITY hive under Policy\Secrets
Why it's wrong here
The Policy\Secrets key stores sensitive system secrets such as LSA secrets and service account credentials. It contains no USB device enumeration data and no connection timestamps, so it is entirely irrelevant to determining when a USB mass storage device was last connected.
- ✗
The SOFTWARE hive under Microsoft\Windows\CurrentVersion\Uninstall
Why it's wrong here
The Uninstall key tracks installed software for the Programs and Features list. It has no relationship to USB device connections and would not contain any timestamps or device instance information, so it cannot answer when a USB mass storage device was last connected.
- ✓
The SYSTEM hive under CurrentControlSet\Enum\USBSTOR
Why this is correct
The USBSTOR key in the SYSTEM hive records USB mass storage devices and, within each device instance, the Properties subkey holds timestamps such as the first and last connection times. This makes it the correct artifact for determining when a USB device was last connected to the system.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.