GFACT CERTIFICATION EXAM
GIAC Foundational Cybersecurity Technologies
COMPREHENSIVE PRACTICE EXAM — EDITION
GIAC / SANS SEC275 | 75 Questions | 6 Exam Domains
2-Hour Time Limit | Passing Score: 71% (54/75)
Aligned with the Official GIAC GFACT 2026–2027 Exam Blueprint
Multiple Choice (A–D) | Correct answers marked ✓
,SECTION 1: Foundations of Computing – Hardware, Virtualization, Cloud,
Scripting (20% — Q1–Q15)
Q1. Which component of a computer is often referred to as the 'brain' because it performs
calculations and executes instructions?
A. RAM (Random Access Memory)
B. GPU (Graphics Processing Unit)
C. CPU (Central Processing Unit) ✓
D. ROM (Read-Only Memory)
Correct Answer: C | Rationale: The CPU (Central Processing Unit) is the primary component that
fetches, decodes, and executes instructions. RAM provides temporary data storage for running processes;
the GPU handles graphics rendering; ROM is non-volatile storage that retains data without power.
Q2. A technician needs to store data that must survive a power outage without any battery
backup. Which memory type is BEST suited?
A. RAM
B. Cache memory
C. ROM ✓
D. Swap space
Correct Answer: C | Rationale: ROM (Read-Only Memory) is non-volatile, meaning it retains data
without power. RAM and cache are volatile and lose their contents when power is removed. Swap space
is disk-based virtual memory, not a true non-volatile memory solution for firmware or critical data.
Q3. A developer runs a program that immediately reads the same dataset thousands of times
per second. Which hardware feature MOST directly speeds up repeated data access?
A. Adding more RAM
B. Cache memory on the CPU ✓
C. Upgrading to a faster hard drive
D. Increasing the GPU clock speed
Correct Answer: C | Rationale: Cache memory sits between the CPU and RAM, storing frequently
accessed data so the processor can retrieve it in nanoseconds rather than waiting hundreds of
nanoseconds for main RAM. More RAM helps with multitasking; faster storage helps with disk I/O; GPU
speed is irrelevant to general computation caching.
Q4. Which type of hypervisor runs DIRECTLY on the physical hardware without requiring a host
operating system?
A. Type 2 (hosted) hypervisor
B. Container runtime
C. Type 1 (bare-metal) hypervisor ✓
, D. Paravirtualization adapter
Correct Answer: C | Rationale: Type 1 (bare-metal) hypervisors (e.g., VMware ESXi, Microsoft Hyper-
V Server, KVM) install directly on hardware and manage guest VMs without a host OS. Type 2
hypervisors (e.g., VirtualBox, VMware Workstation) run on top of a host OS. Containers share the host
kernel — they are not hypervisors.
Q5. An organization wants to improve disaster recovery by quickly restoring entire server
environments from snapshots. Which virtualization benefit BEST addresses this requirement?
A. Server consolidation onto fewer physical hosts
B. Improved disaster recovery through VM snapshots and rapid restoration ✓
C. Elimination of software licensing costs
D. Automatic patching of guest operating systems
Correct Answer: B | Rationale: VM snapshots capture the entire state of a virtual machine (disk,
memory, CPU state) at a point in time, enabling rapid rollback or restoration to a known-good state —
a core DR advantage. Server consolidation and cost reduction are separate benefits; VM snapshots do
not automate OS patching.
Q6. Which statement BEST describes containers compared to virtual machines?
A. Containers each run their own dedicated OS kernel, providing stronger isolation than
VMs
B. Containers package code and dependencies, share the host OS kernel, start
faster, but provide less isolation than VMs ✓
C. Containers require a Type 1 hypervisor and cannot run on bare metal
D. Containers are slower to start than VMs because they include a full OS image
Correct Answer: B | Rationale: Containers (e.g., Docker) share the host kernel, making them
lightweight and fast-starting. VMs each have their own OS kernel, providing stronger isolation but
consuming more resources. Containers do NOT require a hypervisor and can run directly on a Linux
host.
Q7. A company wants to host its web application without managing servers, OS updates, or
middleware — only writing and deploying code. Which cloud service model BEST fits this need?
A. IaaS (Infrastructure as a Service)
B. PaaS (Platform as a Service) ✓
C. SaaS (Software as a Service)
D. FaaS (Function as a Service)
Correct Answer: B | Rationale: PaaS (e.g., Google App Engine, Azure App Service, Heroku) provides a
managed platform where developers deploy code without managing infrastructure, OS, or runtime. IaaS
provides VMs and raw infrastructure; SaaS provides complete applications (e.g., Gmail); FaaS is a more
granular serverless model not listed in the standard three-tier cloud model.
GIAC Foundational Cybersecurity Technologies
COMPREHENSIVE PRACTICE EXAM — EDITION
GIAC / SANS SEC275 | 75 Questions | 6 Exam Domains
2-Hour Time Limit | Passing Score: 71% (54/75)
Aligned with the Official GIAC GFACT 2026–2027 Exam Blueprint
Multiple Choice (A–D) | Correct answers marked ✓
,SECTION 1: Foundations of Computing – Hardware, Virtualization, Cloud,
Scripting (20% — Q1–Q15)
Q1. Which component of a computer is often referred to as the 'brain' because it performs
calculations and executes instructions?
A. RAM (Random Access Memory)
B. GPU (Graphics Processing Unit)
C. CPU (Central Processing Unit) ✓
D. ROM (Read-Only Memory)
Correct Answer: C | Rationale: The CPU (Central Processing Unit) is the primary component that
fetches, decodes, and executes instructions. RAM provides temporary data storage for running processes;
the GPU handles graphics rendering; ROM is non-volatile storage that retains data without power.
Q2. A technician needs to store data that must survive a power outage without any battery
backup. Which memory type is BEST suited?
A. RAM
B. Cache memory
C. ROM ✓
D. Swap space
Correct Answer: C | Rationale: ROM (Read-Only Memory) is non-volatile, meaning it retains data
without power. RAM and cache are volatile and lose their contents when power is removed. Swap space
is disk-based virtual memory, not a true non-volatile memory solution for firmware or critical data.
Q3. A developer runs a program that immediately reads the same dataset thousands of times
per second. Which hardware feature MOST directly speeds up repeated data access?
A. Adding more RAM
B. Cache memory on the CPU ✓
C. Upgrading to a faster hard drive
D. Increasing the GPU clock speed
Correct Answer: C | Rationale: Cache memory sits between the CPU and RAM, storing frequently
accessed data so the processor can retrieve it in nanoseconds rather than waiting hundreds of
nanoseconds for main RAM. More RAM helps with multitasking; faster storage helps with disk I/O; GPU
speed is irrelevant to general computation caching.
Q4. Which type of hypervisor runs DIRECTLY on the physical hardware without requiring a host
operating system?
A. Type 2 (hosted) hypervisor
B. Container runtime
C. Type 1 (bare-metal) hypervisor ✓
, D. Paravirtualization adapter
Correct Answer: C | Rationale: Type 1 (bare-metal) hypervisors (e.g., VMware ESXi, Microsoft Hyper-
V Server, KVM) install directly on hardware and manage guest VMs without a host OS. Type 2
hypervisors (e.g., VirtualBox, VMware Workstation) run on top of a host OS. Containers share the host
kernel — they are not hypervisors.
Q5. An organization wants to improve disaster recovery by quickly restoring entire server
environments from snapshots. Which virtualization benefit BEST addresses this requirement?
A. Server consolidation onto fewer physical hosts
B. Improved disaster recovery through VM snapshots and rapid restoration ✓
C. Elimination of software licensing costs
D. Automatic patching of guest operating systems
Correct Answer: B | Rationale: VM snapshots capture the entire state of a virtual machine (disk,
memory, CPU state) at a point in time, enabling rapid rollback or restoration to a known-good state —
a core DR advantage. Server consolidation and cost reduction are separate benefits; VM snapshots do
not automate OS patching.
Q6. Which statement BEST describes containers compared to virtual machines?
A. Containers each run their own dedicated OS kernel, providing stronger isolation than
VMs
B. Containers package code and dependencies, share the host OS kernel, start
faster, but provide less isolation than VMs ✓
C. Containers require a Type 1 hypervisor and cannot run on bare metal
D. Containers are slower to start than VMs because they include a full OS image
Correct Answer: B | Rationale: Containers (e.g., Docker) share the host kernel, making them
lightweight and fast-starting. VMs each have their own OS kernel, providing stronger isolation but
consuming more resources. Containers do NOT require a hypervisor and can run directly on a Linux
host.
Q7. A company wants to host its web application without managing servers, OS updates, or
middleware — only writing and deploying code. Which cloud service model BEST fits this need?
A. IaaS (Infrastructure as a Service)
B. PaaS (Platform as a Service) ✓
C. SaaS (Software as a Service)
D. FaaS (Function as a Service)
Correct Answer: B | Rationale: PaaS (e.g., Google App Engine, Azure App Service, Heroku) provides a
managed platform where developers deploy code without managing infrastructure, OS, or runtime. IaaS
provides VMs and raw infrastructure; SaaS provides complete applications (e.g., Gmail); FaaS is a more
granular serverless model not listed in the standard three-tier cloud model.
