GCFA Practice Test 13 — 15 Questions

Question 1

During an enterprise incident response, you are examining a compromised Windows system and suspect the attacker used a rootkit to hide a malicious service. You have obtained a memory image and a disk image. Which of the following techniques is most effective for detecting a hidden service that is not visible through standard API calls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyzing the memory image for service records using a tool like Volatility.. Rootkits often hook user-mode APIs to hide their presence, so tools that rely on those APIs (like Services.msc or sc query) may not show the malicious service. Memory forensics tools like Volatility directly parse kernel structures such as the service list, which are harder for rootkits to manipulate without causing instability. This allows detection of services that are hidden from standard interfaces. Antivirus may also be bypassed, making memory analysis the most effective approach.

Answer

Running a full antivirus scan with updated signatures.

Answer

Enumerating services using the Services.msc GUI.

Answer

Comparing the output of 'sc query' with the service list from the registry.

Question 2

An analyst is reviewing a Windows Server 2019 host and finds that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' exists under Task Scheduler Library\Microsoft\EdgeUpdate. The task's action launches 'C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' with the argument '/ua', and the task's XML shows it was created by 'NT AUTHORITY\SYSTEM'. The XML file in C:\Windows\System32\Tasks was last modified three months ago, matching the install date of Edge. Which assessment is MOST accurate?

Accepted Answer

The task appears legitimate, but the analyst should verify the binary's digital signature and compare the creation timestamp against the Edge installation baseline.. Every attribute of the task — its folder, name, executable, argument, owner, and modification time — is consistent with the Edge updater installed on the server. Scheduled tasks are nonetheless a popular persistence vector, so the correct posture is to corroborate with signature verification and timestamp comparison against the known Edge installation baseline before clearing it.

Answer

The task is definitely a persistence mechanism because it runs at logon and uses the '/ua' switch, which is undocumented.

Answer

The task is malicious persistence because SYSTEM-created tasks in the Microsoft namespace are not legitimate.

Answer

The task is suspicious because the executable path uses the 'Program Files (x86)' directory on a 64-bit server.

Question 3

An investigator is preparing to analyze a Windows 10 workstation's NTFS volume using a forensic tool that reads the master file table (MFT) directly. The goal is to build a timeline that includes timestamps for files that were deleted before the acquisition. Which artifact should the investigator primarily rely on to recover timestamps for deleted files?

Accepted Answer

The $MFT file and its unallocated MFT entry records. Unallocated MFT entries preserve the $STANDARD_INFORMATION and $FILE_NAME attributes of deleted files until those entries are reused. By parsing the $MFT, including slack and unallocated records, an analyst can recover the four MACB timestamps for files that no longer exist in the active file system, which is essential for a complete forensic timeline.

Answer

The $LogFile transaction log

Answer

The $UsnJrnl:$J change journal

Answer

The $Bitmap allocation file

Question 4

A forensic analyst is examining an ext4 file system image from a Linux server. Using fls and istat from The Sleuth Kit, the analyst sees a deleted file whose inode still contains block pointers that now point to blocks reallocated to another file. The analyst wants to determine whether the deleted file's content can be recovered intact. Which ext4 condition best explains why the content is likely unrecoverable?

Accepted Answer

The file's data blocks have been reallocated to another inode, so the original content is overwritten. On ext4, deleting a file frees its data blocks but often leaves the inode's block pointers intact until the inode is reused. Recovery is possible only while those blocks remain unallocated and unmodified. When the blocks are reallocated to another file and written, the original data is overwritten, so the deleted file's content cannot be recovered intact even though the inode still references the block numbers.

Answer

The ext4 extent tree was converted to indirect block mapping, invalidating the pointers

Answer

The inode's deletion time in the superblock has been overwritten by the journal

Answer

The inode's link count was set to zero, which automatically zeroes all data block pointers

Question 5

During a memory forensics investigation, an analyst observes a process with a parent process ID (PPID) that does not correspond to any active process in the windows.pslist output. The analyst suspects process injection or process hollowing. Which Volatility 3 plugin should the analyst use to identify processes that may be hidden from the active process list by comparing the linked list to a pool tag scan?

Accepted Answer

windows.psscan. windows.psscan uses pool tag scanning to locate EPROCESS structures in memory, which can uncover processes that have been unlinked from the active process list by rootkits or other hiding techniques. By comparing its output with windows.pslist, an analyst can identify discrepancies indicating hidden processes. The other plugins either rely on the active list or serve different purposes, such as command-line retrieval or network connection enumeration.

Answer

windows.netscan

Answer

windows.pstree

Answer

windows.cmdline

Question 6

An investigator is building a file system timeline for an NTFS volume from a Windows 10 workstation. The user claims a file was copied to an external drive at 14:00, but the file's NTFS Standard Information Attribute shows only a modification timestamp of 13:45. Which NTFS artifact should the investigator examine to determine when the filename was actually created or renamed on the volume?

Accepted Answer

$FILE_NAME creation time. The $FILE_NAME attribute creation timestamp is updated when a filename is created or changed on an NTFS volume, making it a key artifact for detecting copy or rename activity. Unlike $STANDARD_INFORMATION, it is less commonly manipulated by user-mode APIs. In this case, it can reveal whether the filename appeared around 14:00, supporting or contradicting the user's statement.

Answer

$LogFile transaction records

Answer

Volume Shadow Copy creation time

Answer

$STANDARD_INFORMATION creation time

Question 7

An analyst is using The Sleuth Kit to analyze an NTFS image. They run `fls -r -m C:/` to generate a body file and then `mactime -b bodyfile -d` to produce a timeline. They notice that the timeline includes entries for files with a '$' prefix, such as $MFT, $LogFile, and $Bitmap. What is the most appropriate action for the analyst to take regarding these entries?

Accepted Answer

Include them in the timeline and analyze their timestamps as they can provide evidence of file system activity and potential anti-forensic actions.. NTFS system files such as $MFT, $LogFile, and $Bitmap are essential components of the file system and their timestamps can provide critical evidence. They should be included in the timeline because they can show file system events, such as when the MFT was last written or when the log file was updated, which may correlate with user activity or anti-forensic actions. Excluding them would omit valuable data.

Answer

Convert them to a separate timeline using a different tool because The Sleuth Kit cannot correctly interpret their timestamps.

Answer

Immediately report them as indicators of compromise because their presence in the timeline suggests unauthorized access.

Answer

Exclude them from the timeline because they are system files and not relevant to user activity.

Question 8

An analyst is examining a Linux server suspected of compromise. In /var/log/auth.log, they observe repeated entries of the form: 'sshd[1234]: Accepted publickey for deploy from 10.20.30.40 port 51515 ssh2: RSA SHA256:...' followed by 'sshd[1234]: pam_unix(sshd:session): session opened for user deploy'. No corresponding 'Failed password' entries appear for that source IP. Which interpretation is MOST accurate?

Accepted Answer

The session was established using a valid SSH public key, indicating successful key-based authentication from 10.20.30.40.. The 'Accepted publickey' line with an RSA SHA256 fingerprint shows sshd validated the client's key, and the subsequent pam_unix session-open confirms a login session. The absence of prior 'Failed password' entries from that IP rules out a brute-force narrative. Key-based access is the correct interpretation, subject to verifying the key's ownership and the trustworthiness of the source address.

Answer

The session was established through a brute-force password attack that succeeded after many failures.

Answer

The session was established through a reverse shell initiated by a malicious payload on the server.

Answer

The session was established through SSH agent forwarding from an untrusted host, which is why no password prompt was logged.

Question 9

You are examining a Windows 10 memory image and need to determine whether a driver was loaded but subsequently unloaded, potentially concealing malicious activity. Which Volatility 3 plugin should you run to list previously loaded kernel modules that are no longer present in the active module list?

Accepted Answer

windows.modscan. To find drivers that were loaded and then unloaded, you need a plugin that scans kernel pool for module structures rather than relying on the active PsLoadedModuleList. windows.modscan performs exactly that pool scan and can recover residual module metadata, whereas the other plugins either list only active modules or focus on driver objects and IRP hooks, which would not reliably surface an unloaded driver.

Answer

windows.modules

Answer

windows.driverscan

Answer

windows.driverirp

Question 10

An analyst reviewing a Windows workstation finds that the file C:\Windows\System32\drivers\etc\hosts has been modified and now contains several entries mapping well-known banking domains to 127.0.0.1. The file's LastWriteTime is two days ago, and no administrator has reported making the change. Which conclusion is MOST appropriate?

Accepted Answer

The modification is consistent with host-file redirection used to block or intercept traffic to specific domains and warrants further investigation.. Redirecting well-known banking domains to 127.0.0.1 through the hosts file is a recognized adversary technique for intercepting or blocking traffic, and the unexplained, recent modification makes it more suspicious. The appropriate response is to investigate the change, identify the process or account responsible, and examine the host for related indicators rather than dismissing it as routine or user-initiated.

Answer

The modification indicates that the DNS Client service has been disabled on the host.

Answer

The modification is benign because hosts-file changes are always performed by the user for ad-blocking purposes.

Answer

The modification is a normal Windows update behavior and should be ignored.

Question 11

A forensic analyst is building a timeline from an NTFS volume and wants to include the time when a file's metadata was last changed, such as permission modifications. Which timestamp should the analyst focus on to capture this event?

Accepted Answer

Entry modified time (ctime). In NTFS, the entry modified time (ctime) is updated whenever the file's MFT record is changed, which includes modifications to security descriptors, ownership, and other metadata. This makes it the correct timestamp for detecting permission changes. The modified time (mtime) only reflects data writes, the accessed time (atime) reflects reads, and the creation time (crtime) is fixed at file creation. Thus, ctime is the key timestamp for metadata alterations such as permission modifications.

Answer

Accessed time (atime)

Answer

Modified time (mtime)

Answer

Creation time (crtime)

Question 12

A forensic analyst captures a memory image from a Windows 10 workstation suspected of malware infection. The analyst wants to quickly enumerate loaded kernel modules and compare them against the list of modules reported by the operating system to spot discrepancies. Which Volatility 3 plugin should the analyst use to list loaded kernel modules directly from the memory image?

Accepted Answer

windows.modules. The windows.modules plugin is designed to walk the kernel's loaded module list (PsLoadedModuleList) and display each module's name, base address, size, and path. This directly supports the analyst's goal of enumerating kernel modules from a memory image and comparing them against the operating system's reported list to identify discrepancies.

Answer

windows.svcscan

Answer

windows.dlllist

Answer

windows.driverscan

Question 13

An incident responder acquires a memory image from a Windows Server 2016 system suspected of being compromised. The responder wants to identify network connections that were active at the time of capture, including the associated process names and ports. Which Volatility 3 plugin should the responder use to list active network connections from the memory image?

Accepted Answer

windows.netscan. In Volatility 3, the windows.netscan plugin is designed to scan memory for network connection structures, providing details such as local and remote addresses, ports, and owning process IDs. It works by pool tag scanning, which can uncover connections even if they are not in the active list. The other options are either Volatility 2 plugins or non-existent, making windows.netscan the correct choice.

Answer

windows.sockets

Answer

windows.netstat

Answer

windows.connections

Question 14

An analyst is examining a memory dump from a Windows system infected with a rootkit that hooks the System Service Dispatch Table (SSDT). The analyst wants to identify which kernel functions have been hooked by comparing the SSDT entries to the original values. Which Volatility 3 plugin should the analyst use to detect SSDT hooks?

Accepted Answer

windows.ssdt. The windows.ssdt plugin specifically parses the System Service Dispatch Table and compares each service routine pointer to the expected function address within the owning kernel module. Discrepancies indicate hooks, often used by rootkits to intercept system calls. The other plugins focus on callbacks, IRP handlers, or device trees, none of which directly analyze the SSDT for hooked entries.

Answer

windows.driverirp

Answer

windows.devicetree

Answer

windows.callbacks

Question 15

A forensic analyst is creating a timeline from a Windows 10 workstation using fls and mactime from The Sleuth Kit. The analyst notices that the bodyfile contains entries with timestamps that appear to be off by several hours compared to the wall-clock time the incident was reported. The system is known to be set to UTC in the BIOS. Which action best ensures the timeline is correctly aligned for reporting?

Accepted Answer

Verify the time zone configuration and document whether timestamps are stored in UTC, then normalize all timeline entries to UTC for comparison.. NTFS timestamps are recorded in UTC, so a timeline built from them should be normalized to UTC to avoid ambiguity and to allow correlation with other UTC-based sources such as event logs. Documenting the system's time zone configuration provides context for user-facing times but does not change the underlying UTC values. Arbitrary adjustment of timestamps undermines the integrity of the timeline.

Answer

Apply the Windows time zone setting from the registry to convert the timestamps to local time before analysis.

Answer

Discard the bodyfile and regenerate it using a tool that automatically converts timestamps to the analyst's local time zone.

Answer

Adjust each timestamp by the offset observed in the bodyfile until the timeline matches the incident report time.