GCFA Windows Artifact Analysis Practice Question
Which registry hive contains the 'UserAssist' key, and what is its primary forensic value?
⚠ Common exam trap
Candidates often confuse the UserAssist hive location with the SYSTEM hive or assume it tracks all system-wide background services, ignoring its specific focus on user-initiated GUI program execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NTUSER.DAT hive; tracking user-initiated program execution
UserAssist is stored within the NTUSER.DAT hive of the specific user account. Its value lies in the rotational cipher (ROT13) used for the data, which, once decrypted, reveals a list of GUI-based programs executed by the user. This artifact is invaluable for linking specific user activity to the execution of malicious tools, providing proof that the user was behind the keyboard during the incident, as opposed to an automated system service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYSTEM hive; tracking system services
Why it's wrong here
The SYSTEM hive tracks system-wide configuration, including service settings and hardware, not user-level application execution. UserAssist is a per-user artifact located in the NTUSER.DAT hive, which is specific to individual user profiles, whereas the SYSTEM hive is not associated with any single interactive user account.
- ✓
NTUSER.DAT hive; tracking user-initiated program execution
Why this is correct
UserAssist is located in the NTUSER.DAT hive, which is unique to each user profile on the system. It tracks the programs the user launches via the Windows shell, recording execution counts and timestamps, making it the primary artifact for identifying user-driven activity during an investigation.
- ✗
SOFTWARE hive; tracking installed application paths
Why it's wrong here
The SOFTWARE hive contains global installation information and registry settings for applications, but it does not record dynamic execution history or user-specific interaction patterns. UserAssist is far more granular and user-focused, making it the correct choice for identifying what a specific user actually executed on the system.
- ✗
SECURITY hive; tracking authentication logs
Why it's wrong here
The SECURITY hive stores local security policies and credentials. It does not track application execution history or user-initiated GUI activity. UserAssist is entirely independent of the security hive, which is concerned with authentication and account-related security configurations rather than user application behavior and usage patterns.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.