GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
During an investigation of a compromised Windows Server 2019, an analyst extracts the ShimCache (AppCompatCache) from the SYSTEM registry hive. The analyst needs to determine which executable was present on the system but may have been deleted. Which artifact within the ShimCache entry provides the best indication of file existence and last modification time?
⚠ Common exam trap
It's easy for candidates to confuse ShimCache with artifacts like UserAssist or AmCache that track execution or hashes; ShimCache only records file paths and last modified times.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file path and last modified timestamp
ShimCache entries include the file path and, on Windows 8+, a last modified timestamp from the file's $STANDARD_INFORMATION attribute. This timestamp helps determine when the file was last modified, and the presence of the path confirms the file existed. Execution flags and run counts are not part of ShimCache; those are in UserAssist or Prefetch. Process IDs and hashes are also not stored in ShimCache.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SHA256 hash of the executable
Why it's wrong here
ShimCache does not store file hashes. Hashes would need to be computed from the actual file or from other artifacts like AmCache. While AmCache may contain hashes, ShimCache does not. Therefore, this option is incorrect because it suggests data that is not part of the ShimCache structure.
- ✗
The execution flag and run count
Why it's wrong here
ShimCache does not contain an execution flag or run count. Those are features of the UserAssist and Prefetch artifacts. ShimCache only records file paths and, on newer Windows versions, last modified timestamps. Therefore, this option is incorrect because it describes data not present in ShimCache.
- ✗
The process ID and parent process ID
Why it's wrong here
ShimCache does not store process IDs or parent process IDs. Those are found in event logs or memory artifacts. ShimCache is a compatibility database that tracks executable paths to mitigate application compatibility issues. Thus, this option is incorrect as it misattributes data to ShimCache.
- ✓
The file path and last modified timestamp
Why this is correct
The ShimCache entry contains the full file path and, on Windows 8 and later, a last modified timestamp from the file's $STANDARD_INFORMATION attribute. This timestamp indicates when the file was last modified, not when it was executed. However, the presence of a path in ShimCache confirms the file existed on the system at some point, which is valuable for identifying deleted executables. This makes it the correct choice for determining file existence and last modification time.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.