GCFA Practice Test 10 — 10 Questions

Question 1

A workstation shows signs of an attacker establishing persistence. You want to identify a scheduled task that runs a suspicious binary at user logon. Which Windows artifact should you examine to find the task's action and trigger configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file C:\Windows\System32\Tasks\<TaskName> in the Task Scheduler store. Scheduled tasks are defined as XML files in the Task Scheduler store under C:\Windows\System32\Tasks, and each file includes the task's Triggers and Actions. A logon trigger with an action launching a suspicious binary is exactly the persistence configuration described, so inspecting that XML file directly reveals both the executable and the trigger that causes it to run at logon.

Answer

The Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders key in the SOFTWARE hive

Answer

The Microsoft\Windows NT\CurrentVersion\Winlogon key's Shell value in the SOFTWARE hive

Answer

The Software\Microsoft\Windows\CurrentVersion\Run key in the NTUSER.DAT hive

Question 2

An organization is responding to a ransomware incident. The attackers encrypted files on several servers and left a ransom note. Which immediate action should the incident response team take to preserve the most volatile evidence before shutting down the affected systems?

Accepted Answer

Collect volatile data such as memory and network connections.. The order of volatility dictates that the most volatile evidence, such as memory and network connections, should be collected first. In a ransomware incident, memory can contain encryption keys and indicators of compromise that are crucial for response and recovery. Disk imaging and containment actions can be performed afterward without losing this critical data. Interviews are non-technical and can be done at any time.

Answer

Interview system administrators about the ransomware note.

Answer

Disconnect the servers from the network to prevent further spread.

Answer

Capture a forensic image of the disk drives.

Question 3

An analyst is examining a Windows 10 system and wants to determine the last time a specific user logged on interactively. Which Windows Event Log should be examined to find the most recent interactive logon event?

Accepted Answer

Security Event Log, Event ID 4624 with Logon Type 2. Security Event ID 4624 with Logon Type 2 records interactive logons at the console. By examining the most recent such event, an analyst can determine when a user last logged on interactively. System Event ID 6005 relates to service startup, Application Event ID 1000 to application crashes, and Security Event ID 4634 to logoffs, none of which answer the question.

Answer

Application Event Log, Event ID 1000

Answer

Security Event Log, Event ID 4634

Answer

System Event Log, Event ID 6005

Question 4

During an enterprise-wide incident response, a Windows workstation is suspected of being compromised by a threat actor who used a spear-phishing document. The machine is still powered on and the user is logged in. You need to capture volatile evidence in a forensically sound manner. Which of the following is the correct order of volatility for collecting evidence, from most volatile to least volatile?

Accepted Answer

CPU registers and cache, routing table, RAM, temporary file systems, disk. The order of volatility dictates that the most perishable evidence be collected first. CPU registers and cache change with every instruction, routing tables and ARP caches expire quickly, and RAM loses its contents on power-off. Temporary file systems and disk are comparatively persistent. Following this sequence preserves the most fragile evidence before it is altered or destroyed by normal system activity or shutdown.

Answer

Temporary file systems, disk, RAM, routing table, CPU registers and cache

Answer

Disk, RAM, temporary file systems, routing table, CPU registers and cache

Answer

RAM, CPU registers and cache, disk, temporary file systems, routing table

Question 5

A forensic analyst is reviewing a Windows 10 workstation suspected of unauthorized data staging. While parsing the Master File Table with a commercial forensic suite, the analyst observes that a suspicious .zip file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps by more than six months, and the $FILE_NAME timestamps are older. Which conclusion is most consistent with this artifact pattern?

Accepted Answer

The $STANDARD_INFORMATION timestamps were likely altered by a timestomping utility, while the $FILE_NAME timestamps retained the original values.. NTFS stores two independent timestamp sets per file: $STANDARD_INFORMATION, writable through normal APIs, and $FILE_NAME, set at creation and rename. Anti-forensic tools commonly change only the former, producing a divergence where $FILE_NAME timestamps are older. This pattern is a reliable indicator of timestomping and should prompt deeper timeline analysis.

Answer

The file was created on a different NTFS volume and later copied onto this workstation using a tool that preserves $FILE_NAME timestamps.

Answer

The file was accessed by a backup application that updates only $STANDARD_INFORMATION timestamps during incremental backups.

Answer

The file system is corrupt and the $FILE_NAME attribute should be treated as unreliable, so only the $STANDARD_INFORMATION timestamps should be used for the timeline.

Question 6

During a forensic investigation of a Windows 10 system, an analyst examines a memory dump and finds a process named 'svchost.exe' with a parent process ID (PPID) of 1234. The analyst runs 'vol -f memory.dmp windows.pslist' and sees that PID 1234 is not present in the output. Which of the following conclusions is most likely correct?

Accepted Answer

The parent process has terminated, and the PPID is now stale.. When a parent process terminates, its child processes continue to run, and the child's PPID remains set to the now-invalid parent PID. This results in a stale PPID. The absence of PID 1234 in the active process list indicates that the parent has likely terminated, which is a normal occurrence and not inherently malicious.

Answer

The memory dump is corrupted and the process list is incomplete.

Answer

The process 'svchost.exe' is a known Windows service and its parent should always be 'services.exe'.

Answer

The PPID indicates that the parent process is hidden by a rootkit and should be recovered using psscan.

Question 7

An analyst is examining an NTFS volume and wants to identify the MFT entry for a specific file named 'report.docx'. The analyst knows the file's path but needs to locate its MFT record number to examine its attributes. Which NTFS metadata file should the analyst consult to map the file path to its MFT record number?

Accepted Answer

$Index allocation attributes within directory entries. To map a file path to its MFT record number, an examiner must traverse the directory index structures. Directories in NTFS use $INDEX_ROOT and $INDEX_ALLOCATION attributes to store entries that associate file names with MFT record numbers. Starting from the root directory and following each path component leads to the target file's record.

Answer

$Bitmap

Answer

$MFT

Answer

$Root

Question 8

During an investigation of a compromised Windows 10 workstation, a forensic analyst reviews the NTFS $MFT and observes that the Standard Information Attribute (SIA) timestamps for a suspicious executable in C:\Windows\Temp are all identical, while the File Name Attribute (FNA) timestamps show a different, earlier date. The executable has no corresponding Prefetch file. Which conclusion is most strongly supported by these artifacts?

Accepted Answer

The file was likely placed by a tool that manipulated $STANDARD_INFORMATION timestamps to hinder timeline analysis, and it may not have been executed on this system.. Identical $STANDARD_INFORMATION timestamps paired with differing $FILE_NAME timestamps indicate timestomping, because the SIA can be modified by user-mode APIs while the FNA is updated only by the kernel during file creation or rename. The absence of a Prefetch file means the analyst cannot confirm execution from these artifacts alone, and the file's location in C:\Windows\Temp further supports a malicious or suspicious origin rather than normal installation.

Answer

The file was created by a legitimate installer that preserved original timestamps, and the lack of Prefetch is due to a disabled SysMain service.

Answer

The file is encrypted by EFS, which alters $STANDARD_INFORMATION timestamps and prevents Prefetch creation until the file is decrypted.

Answer

The file is a legitimate Windows component that was moved from another volume, causing the SIA and FNA timestamps to diverge and Prefetch to be absent.

Question 9

You are examining a Windows Server 2019 memory image after a suspected credential-theft incident. You need to identify which process was used to access the LSASS process memory at the time of capture. Which Volatility 3 plugin and artifact combination most directly reveals handles opened to the LSASS process by other processes?

Accepted Answer

windows.handles, filtering for handles to the lsass.exe process object. Handle tables record which process opened an object and what type it is. Filtering the handle output for the lsass.exe process object pinpoints processes that held a handle to LSASS at capture time, which is strong evidence of memory access. Injected-memory, network, and loaded-module plugins examine other artifacts and do not answer who opened the handle.

Answer

windows.netscan, filtering for connections owned by lsass.exe

Answer

windows.dlllist, focusing on unsigned DLLs loaded into lsass.exe

Answer

windows.malfind, looking for PAGE_EXECUTE_READWRITE regions in lsass.exe

Question 10

A GCFA analyst is reviewing a Windows 10 memory image to identify user activity. The analyst wants to find the most recently typed commands in a command prompt window that was open at the time of acquisition. Which volatile artifact would provide this information?

Accepted Answer

The console history buffer in the conhost.exe process memory.. The console history buffer in conhost.exe memory contains the commands typed in a command prompt window during the session. This volatile artifact is not written to disk by default, so it can only be recovered from a memory image. The PSReadLine history file is for PowerShell and is persistent, while event logs and cmdline plugins do not capture interactive command history. Therefore, the conhost.exe buffer is the correct source.

Answer

The windows.cmdline plugin output showing the command line of cmd.exe.

Answer

The Windows Event Log 'Microsoft-Windows-CommandPrompt/Operational' with command history events.

Answer

The PowerShell console history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.