GCFA Practice Test 14 — 15 Questions

Question 1

You are analyzing a Linux web server and find that /var/log/auth.log contains many 'Failed password' entries followed by a single 'Accepted password' for the account 'deploy' from the same source IP. Shortly after, you see a sudo command adding a new user named 'support' to the sudoers file. Which sequence best describes what occurred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A brute-force password attack succeeded against the deploy account, and the attacker then escalated privileges via sudo.. The sequence of many failed password attempts ending in one success from the same IP shows a successful credential-guessing attack. The immediate sudo action that adds a new sudoer account indicates the attacker established persistence and elevated access. Investigators should trace the source IP, review command history and auth logs for the session, and check for additional accounts or scheduled jobs created by the attacker.

Answer

A legitimate administrator mistyped the password several times and then correctly added a new support user.

Answer

The deploy account was used by an automated deployment tool that periodically re-authenticates and updates sudoers.

Answer

The server experienced a PAM misconfiguration that logged failed attempts while still allowing the successful login.

Question 2

A forensic analyst is examining a Windows Server 2016 system that is suspected of being compromised. The analyst runs 'wevtutil qe Security /f:text /q:"*[System[(EventID=4688)]]"' and notices that many process creation events have the 'Subject Logon ID' field set to '0x3e7'. Which of the following best describes the significance of this finding?

Accepted Answer

The processes were created by the SYSTEM account, which often indicates that a service or scheduled task spawned them; this could be normal or malicious depending on the process.. The logon ID 0x3e7 is a well-known identifier for the SYSTEM account in Windows. Process creation events with this logon ID indicate that the process was spawned under the SYSTEM context, which is common for services and scheduled tasks. However, because attackers often escalate to SYSTEM, the analyst must examine the process name, command line, and parent process to determine if the activity is malicious. The logon ID alone is not sufficient to declare benign or malicious.

Answer

The processes were created by a user who logged on interactively, as indicated by the logon ID starting with 0x3, which denotes interactive logons.

Answer

The processes were created by a user with a randomly assigned logon ID, which suggests the system is using logon session isolation for security.

Answer

The processes were created by a user with a well-known logon ID, which is typical for system services and indicates no malicious activity.

Question 3

An analyst is reconstructing a suspected credential-dumping incident on a Windows 10 host and has already imaged memory. Which TWO artifacts should the analyst examine to determine whether the LSASS process memory was accessed by an unauthorized tool? (Choose two.)

Accepted Answer

A memory image search for the 'sekurlsa' module strings and Mimikatz driver artifacts in non-paged pool.. Establishing unauthorized LSASS access requires artifacts that either record the access event itself or demonstrate the presence of credential-dumping tooling. Sysmon process-access events capture the target process, requesting image, and granted access mask, while memory-resident strings and driver artifacts left by frameworks like Mimikatz show the tooling was loaded. Together they provide both the access event and the capability evidence.

Answer

Prefetch files showing that the Windows Credential Manager UI was launched by the user.

Answer

Security Event ID 4688 process creation records showing the parent image of every long-running service.

Answer

Amcache entries listing hashes of binaries installed under 'Program Files' on the host.

Question 4

An examiner is reviewing a Windows memory image for evidence of process hollowing. Which two artifacts, when observed together, most strongly support that a process has been hollowed? (Choose two.)

Accepted Answer

The process's primary image memory region is not backed by the file on disk that its path indicates.. Process hollowing unmaps or overwrites the original image and injects replacement code, so the primary image region loses its legitimate file backing and threads often start in unbacked memory. Observing both an unbacked primary image and a thread starting outside known modules forms a coherent, high-confidence pattern. Pipe handles, token privilege changes, and working set size are unrelated to the hollowing technique.

Answer

The process's token has been modified to include SeDebugPrivilege.

Answer

The process has a working set larger than the system average.

Answer

The process has a large number of handles open to named pipes.

Question 5

A forensic analyst is examining a memory image from a Windows 10 system suspected of having a rootkit that hides processes by unlinking them from the active process list. The analyst runs windows.pslist and windows.psscan to compare results. Which two of the following statements accurately describe the expected findings or implications? (Choose two.)

Accepted Answer

Processes present in windows.psscan but absent in windows.pslist are likely hidden by rootkit activity.. The correct statements highlight that windows.psscan can reveal processes hidden from the active list and may also report terminated processes whose structures remain. These behaviors are essential for detecting rootkits that unlink processes. The other statements contain factual errors about the tools' methods or draw unsupported conclusions from identical output.

Answer

Processes present in windows.pslist but absent in windows.psscan indicate that the process terminated normally and its memory was freed.

Answer

If windows.psscan and windows.pslist produce identical output, it definitively proves that no rootkit is present on the system.

Answer

windows.pslist relies on pool tag scanning, while windows.psscan walks the active process list.

Question 6

You are examining a Windows 10 host and find a scheduled task whose XML action launches 'rundll32.exe' with the argument 'C:\ProgramData\Microsoft\Crypto\RSA\logon.dll,Register'. The task's author is a domain user who has never logged on to this machine, and the DLL has a creation timestamp matching the suspected intrusion window. Which assessment is best supported?

Accepted Answer

This is a persistence mechanism using a masqueraded path and an export invoked via rundll32.. Scheduled tasks that invoke rundll32 against a DLL export located in a user-writable directory are a well-known persistence technique because the signed Microsoft binary performs the loading and evades naive process-name detection. The combination of an author account with no local logon history and a DLL creation timestamp inside the intrusion window confirms this is attacker-planted rather than legitimate cryptographic or installer activity.

Answer

This is a benign logon script registered by Group Policy for the domain user.

Answer

This indicates a misconfigured application installer that ran as the wrong domain account.

Answer

This is a legitimate Windows cryptographic component and should be excluded from the investigation.

Question 7

A forensic analyst is examining an NTFS volume and wants to identify potential timestomping. Which TWO artifacts should the analyst compare to detect inconsistencies in file timestamps? (Choose two.)

Accepted Answer

$FILE_NAME timestamps. Timestomping often modifies $STANDARD_INFORMATION timestamps while leaving $FILE_NAME timestamps unchanged. Comparing these two sets can reveal inconsistencies that indicate manipulation. Other artifacts like VBR, $Bitmap, or MFT record headers do not contain comparable per-file timestamps, so they are not useful for this specific detection.

Answer

Volume Boot Record (VBR) timestamps

Answer

$Bitmap timestamps

Answer

Master File Table (MFT) record header timestamps

Question 8

During a memory forensics examination of a Windows 10 system, an analyst observes that a process named 'svchost.exe' has a parent process ID (PPID) that does not correspond to any known system process. The analyst suspects process spoofing. Which Volatility 3 plugin should the analyst use to examine the process's parent-child relationship and verify the legitimacy of the parent process?

Accepted Answer

windows.pstree. The windows.pstree plugin is designed to display processes in a tree structure, showing parent-child relationships. This makes it easy to spot a svchost.exe with an unusual parent, such as a non-system process, which is a common sign of process spoofing. Other plugins like pslist, cmdline, and dlllist do not provide this hierarchical view, making pstree the correct choice for verifying process legitimacy.

Answer

windows.dlllist

Answer

windows.cmdline

Answer

windows.pslist

Question 9

A forensic analyst is examining a memory dump from a Windows Server 2016 system that is suspected of being compromised by a kernel-mode rootkit. The analyst runs Volatility 3 and observes several anomalies. Which two of the following artifacts are most indicative of a kernel-mode rootkit that uses SSDT hooking? (Choose two.)

Accepted Answer

The SSDT is found to be writable in memory, whereas it should be read-only in a clean system.. SSDT hooking involves redirecting system service calls by modifying the SSDT, which normally points to functions within ntoskrnl.exe. Two key indicators are SSDT entries pointing outside ntoskrnl.exe and the SSDT being writable when it should be read-only. Other artifacts like missing driver files or IDT variations are not specific to SSDT hooking, and a modified kernel hash indicates patching rather than hooking.

Answer

The presence of a driver object with no corresponding file on disk in the drivers directory.

Answer

The ntoskrnl.exe module in memory has a different hash than the known-good version from the same Windows build.

Answer

The KPCR (Kernel Processor Control Region) for each CPU shows a different value for the IDT base address.

Question 10

You are examining a Windows 10 memory image and notice a process with a handle to a file named 'svchost.exe' located in a user's temp directory. You want to determine the full path and access type of this handle. Which Volatility 3 plugin should you use?

Accepted Answer

windows.handles. To find the full path and access type of a file handle, you need a plugin that enumerates handles per process. windows.handles provides exactly that, showing the object name (full path) and granted access for each handle. The other plugins focus on scanning file objects without process association, listing loaded DLLs, or displaying privileges, none of which directly answer the question about a specific handle.

Answer

windows.filescan

Answer

windows.privs

Answer

windows.dlllist

Question 11

During a compromise investigation, an analyst reviews Windows Event Logs and observes that Security Event ID 4688 entries are present, but the Process Command Line field is empty for all of them. The system is running Windows 10 Enterprise. What is the most likely reason for the missing command line data?

Accepted Answer

The 'Include command line in process creation events' policy under Administrative Templates\System\Audit Process Creation is not enabled.. The correct answer is the policy that controls command-line inclusion in process creation events. When enabled, it populates the Process Command Line field in Event ID 4688. Without it, the field remains empty. This is a common pitfall because process creation auditing alone does not guarantee command-line visibility; the separate policy must be turned on.

Answer

The Security log has wrapped, and older entries containing command lines were overwritten before collection.

Answer

The Windows Event Log service is configured to filter out command-line data for privacy reasons via a built-in security template.

Answer

Process creation auditing is not enabled at all, so Event ID 4688 should not appear.

Question 12

An investigator is analyzing an NTFS volume from a Windows Server 2016 system that was recently compromised. The attacker used a tool to modify file timestamps to evade detection. The investigator notices that the $STANDARD_INFORMATION timestamps for a suspicious executable are all set to 2018-01-01, while the $FILE_NAME timestamps remain at 2021-06-15. The $MFT entry number is 12345. What is the most accurate conclusion regarding the timestamp manipulation?

Accepted Answer

The attacker used a tool that only modifies $STANDARD_INFORMATION timestamps, and the $FILE_NAME timestamps are likely original and reliable.. The correct answer is the option stating that the attacker modified only $STANDARD_INFORMATION timestamps. Common timestomping tools like timestomp or SetMace often alter the $STANDARD_INFORMATION attribute without updating the $FILE_NAME attribute. This creates a discrepancy where $STANDARD_INFORMATION shows an earlier, uniform date while $FILE_NAME retains the original timestamp. Investigators should compare both sets of timestamps and treat the $FILE_NAME values as more reliable when manipulation is suspected, as they are harder to modify without specialized tools.

Answer

Both sets of timestamps were modified, and the investigator cannot determine which one is original without additional artifacts.

Answer

The $FILE_NAME timestamps were modified by the attacker, and the $STANDARD_INFORMATION timestamps are the original ones.

Answer

The timestamps are consistent with normal system behavior, and no manipulation occurred.

Question 13

During an intrusion investigation, an analyst needs to determine the exact moment a malicious service was installed on a Windows 10 host. The attacker deleted the service's executable and cleared the System event log. Which artifact should the analyst examine to recover the service installation timestamp?

Accepted Answer

Registry key LastWrite time under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>. The Services registry key maintains configuration data for each service, and its LastWrite time updates upon creation or modification. This artifact survives executable deletion and log clearing, offering a reliable timestamp for service installation. Other artifacts like SRUM, Prefetch, or Amcache provide execution or resource usage context but not the specific service registration time.

Answer

SRUM (System Resource Usage Monitor) database

Answer

Amcache.hve inventory entry for the service executable

Answer

Prefetch file for the service executable (e.g., SERVICENAME.EXE-XXXXXXXX.pf)

Question 14

An analyst is examining an NTFS volume from a Windows Server 2019 system that was used as a file server. A file critical to the investigation is missing from the directory listing, but the analyst suspects the file was recently deleted and its MFT entry has not been overwritten. Which NTFS artifact should the analyst examine to recover the file's full path and name if the MFT entry is still intact?

Accepted Answer

$FILE_NAME attribute within the file's MFT record. The $FILE_NAME attribute in the MFT record contains the file's name and a reference to its parent directory's MFT entry. By parsing this attribute and then locating the parent MFT entry, an analyst can reconstruct the full path. Other artifacts like $Bitmap or $UsnJrnl may provide supporting information but do not directly contain the full path.

Answer

$UsnJrnl:$J stream

Answer

$INDEX_ROOT attribute of the parent directory

Answer

$Bitmap metadata file

Question 15

You are analyzing an NTFS volume and need to determine the original path and name of a file that has been moved to a different directory. The file's MFT entry contains multiple $FILE_NAME attributes. Which two of the following statements about $FILE_NAME attributes are correct? (Choose two.)

Accepted Answer

The $FILE_NAME attribute includes a namespace field that indicates whether the name is in the POSIX, Win32, or DOS namespace.. $FILE_NAME attributes represent hard links; each link has a parent directory reference pointing to the directory containing the link. The namespace field indicates the naming convention used. These attributes are always resident and their timestamps update on rename or move, not content modification. Multiple $FILE_NAME attributes therefore indicate multiple hard links, and their parent references help reconstruct directory structure.

Answer

The $FILE_NAME attribute stores the file's original path when the file was moved, and the parent directory reference points to the original directory.

Answer

The $FILE_NAME attribute is updated whenever the file's content is modified, reflecting the last modification time.

Answer

The $FILE_NAME attribute can be resident or non-resident depending on the length of the filename.