GCFA Practice Test 16 — 15 Questions

Question 1

A forensic analyst is examining an NTFS volume and finds that a directory's $I30 index entries are present in the $INDEX_ROOT, but the $INDEX_ALLOCATION attribute is non-resident and points to INDX records. The analyst needs to determine whether a deleted file once existed in that directory. Which artifact should the analyst examine to find residual filename entries that may reference the deleted file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Slack space within the INDX records in the $INDEX_ALLOCATION. When a file is deleted from an NTFS directory, its entry in the $I30 index is removed, but remnants often persist in the slack space of INDX records within the $INDEX_ALLOCATION. These residual entries can contain the filename and file reference number, allowing an analyst to infer the existence of a deleted file. The $BITMAP, $LOGGED_UTILITY_STREAM, and $REPARSE_POINT attributes do not store filename entries.

Answer

The $REPARSE_POINT attribute in the directory's MFT record

Answer

The $LOGGED_UTILITY_STREAM attribute of the directory

Answer

The $BITMAP attribute of the directory's MFT record

Question 2

A forensic analyst is reviewing an NTFS volume and notices that a particular MFT record has an $ATTRIBUTE_LIST attribute. The analyst wants to understand why this attribute is present. Which of the following best describes the purpose of the $ATTRIBUTE_LIST attribute in an MFT record?

Accepted Answer

It provides a mapping of all attributes and their locations when they do not fit in the base MFT record.. The $ATTRIBUTE_LIST attribute is present when a file's attributes cannot all fit in the base MFT record. It lists each attribute and specifies whether it is resident in the base record or in an extension record, along with the MFT reference of that extension record. This allows NTFS to locate all attributes. The other options describe functions of other attributes or metadata files.

Answer

It stores the security descriptor for the file to control access permissions.

Answer

It lists the data runs for the $DATA attribute when the file is fragmented.

Answer

It tracks the change journal entries for the file for auditing purposes.

Question 3

An analyst is reviewing a memory image from a Windows server and needs to identify kernel drivers that were loaded but are not present in the list of modules on disk. The analyst runs the Volatility 3 windows.modules plugin and compares the output to a baseline of known-good drivers. Which additional plugin should the analyst run to detect drivers that have been unlinked from the kernel module list but whose code may still be resident in memory?

Accepted Answer

windows.driverscan. A driver unlinked from PsLoadedModuleList will not appear in the modules plugin output, but its DRIVER_OBJECT may still reside in pool memory. The driverscan plugin locates these objects by scanning pool memory, making it the appropriate cross-check for detecting hidden or unlinked kernel drivers in the image.

Answer

windows.callbacks

Answer

windows.svcscan

Answer

windows.ldrmodules

Question 4

A forensic analyst is examining a Windows 10 memory image for evidence of process injection. The analyst runs several Volatility 3 plugins and reviews the output for indicators of injected code. Which two of the following findings most strongly indicate that a process has been injected with malicious code? (Choose two.)

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE protection that is not backed by a file on disk. Process injection typically manifests as executable memory that is not backed by a file on disk and as threads whose start addresses fall outside any mapped module. These two findings together provide strong evidence that an attacker wrote and executed code within another process, whereas handle counts, working set ratios, and AppData DLL loads have legitimate explanations and are not specific to injection.

Answer

A process with a large number of handles to named pipes

Answer

A process whose working set is larger than its private commit size

Answer

A DLL loaded from a path within the user's AppData directory

Question 5

An analyst is investigating a suspected rootkit on a Windows system and captures a memory image. The analyst runs a plugin that enumerates processes by walking the active process list and notices that a known suspicious process is absent. The analyst then runs a plugin that scans pool memory for process objects and finds the process. Which conclusion is best supported by these findings?

Accepted Answer

The process object was unlinked from the active process list to hide it from standard enumeration.. When a process is missing from the active process list but its object is still discoverable by scanning pool memory, the most likely explanation is that the list entry was removed to conceal the process. This is the classic signature of DKOM-based rootkit hiding, because the object remains allocated and its pointers are intact even though it is no longer linked into the list.

Answer

The process was terminated before the memory image was captured, so only residual pool data remains.

Answer

The pool scan plugin produced a false positive by matching a freed process object that has not yet been reused.

Answer

The process is a legitimate system process that is intentionally excluded from the active process list by the kernel.

Question 6

Which conclusion regarding this network logon event is most accurate based on the provided Windows Event Log details?

Accepted Answer

The authentication utilized NTLMv1 or failed to negotiate encryption. A Logon Type 3 indicates a network logon, typically associated with accessing a shared resource or remote service. The 'NtLmSsp' package signifies NTLM authentication, and the Key Length of 0 indicates that NTLMv1 is being used or encryption is absent. This suggests a legacy or potentially insecure authentication attempt, which is a common indicator of lateral movement using outdated protocols that are susceptible to relay attacks.

Answer

The user performed an interactive console logon

Answer

The event represents a Kerberos ticket granting service request

Answer

The account was locked out due to excessive attempts

Question 7

Which of the following best describes the function of the 'UserAssist' registry key in a Windows forensic investigation?

Accepted Answer

Tracks the execution of GUI-based applications for each user.. UserAssist records information about GUI-based programs executed by a user, including the file path, execution count, and last execution time. It is stored in the user's NTUSER.DAT hive. This artifact is essential for determining user activity, establishing which applications were launched, and identifying the persistence of specific malicious binaries across sessions. It helps investigators prove that a specific user was responsible for launching an application, which is crucial for attribution.

Answer

Tracks all system-wide driver installations and updates.

Answer

Records the last time a user logged onto the system.

Answer

Stores the history of web browsing sessions in Internet Explorer.

Question 8

A forensic analyst is examining an NTFS volume and needs to identify which artifacts can provide evidence of file deletion or file system changes that occurred after a file was removed. Which TWO of the following NTFS artifacts are most directly useful for this purpose? (Choose two.)

Accepted Answer

$UsnJrnl:$J, which logs file system events including FILE_DELETE and CLOSE reasons.. $Bitmap tracks cluster allocation and can show clusters freed by deletion, while $UsnJrnl:$J logs file system events including FILE_DELETE with timestamps and file references. Together they help identify deleted files and the timing of deletions, making them the most directly useful artifacts among the listed metadata files.

Answer

$Volume, which contains the volume label and version information and can indicate volume format changes.

Answer

$AttrDef, which defines valid attribute types and can show when new attributes were added.

Answer

$Boot, which stores the volume boot sector and can indicate when the volume was last mounted.

Question 9

Which NTFS attribute would an investigator primarily examine to determine the parent directory of a specific file?

Accepted Answer

$FILE_NAME. The $FILE_NAME attribute contains the parent directory ID, which is a reference to the directory's record in the MFT. This attribute is essential for building a full path for a file. Because it is maintained by the system kernel, it is also highly reliable for verification against the user-visible paths provided by the $SI attribute, aiding in identifying path-based manipulation.

Answer

$STANDARD_INFORMATION

Answer

$DATA

Answer

$INDEX_ROOT

Question 10

Which TWO of the following behaviors are common indicators of fileless malware execution that a forensic analyst should look for in memory artifacts?

Accepted Answer

Evidence of PowerShell execution using the -EncodedCommand flag.. Fileless malware operates by residing in volatile memory rather than writing traditional binaries to the disk. Analysts must focus on process memory injection, anomalous script execution, and reflective DLL loading. Detecting these requires memory forensics tools to extract and analyze injected code segments or PowerShell command history. This is critical because attackers increasingly use living-off-the-land techniques to evade signature-based antivirus solutions that primarily scan files on disk.

Answer

Creation of an autorun registry key pointing to a hidden .exe file.

Answer

Large volume of deleted files recovered from the $MFT.

Answer

High frequency of DLL load events from the C:\Windows\Temp directory.

Question 11

In the context of memory forensics, what does the term 'Page File' represent in a crash dump?

Accepted Answer

A file that stores inactive virtual memory.. The page file is a disk-based extension of physical RAM. When a system performs a dump, it may contain data swapped from physical memory to the page file. Forensic analysts must understand this because critical evidence—such as decrypted payloads or old process data—might exist in the page file rather than the active physical RAM, requiring the analyst to reconstruct the virtual address space using both sources.

Answer

A reserved section of the CPU cache.

Answer

A list of all allocated kernel drivers.

Answer

A log of all system process launches.

Question 12

An examiner is analyzing a Windows memory image and wants to determine whether a specific kernel driver was loaded and then unloaded during the system's uptime. Which approach is most appropriate?

Accepted Answer

Search for the driver's pool tags and compare them against the current loaded module list to identify remnants of an unloaded driver.. Pool tags and residual pool allocations can persist after a driver unloads, so searching for a driver's known pool tags and comparing against the current module list can reveal that it was loaded earlier. The module list itself only shows current modules, registry keys show configuration, and event logs are not reliable for this purpose in memory forensics.

Answer

Check the system event log for a service control manager entry indicating the driver was started.

Answer

Examine the registry hives in memory for the driver's service key and confirm its start type.

Answer

Run windows.modules and check whether the driver appears in the output.

Question 13

Which indicator is most effective for identifying a 'Golden Ticket' attack during Kerberos-based authentication?

Accepted Answer

Unusually long ticket lifetimes in the Kerberos ticket history.. A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created with a compromised KRBTGT account hash. Because it is forged, it can grant the attacker unlimited access to any resource in the domain for long periods. Identifying this requires looking for tickets with unusually long lifetimes, or tickets that do not match the standard issuance patterns expected from the domain controller's authentication logs during normal operations.

Answer

Multiple failed login attempts on a workstation.

Answer

An increase in web traffic on port 443.

Answer

The presence of a new user account in Active Directory.

Question 14

An analyst is examining a Linux server that is suspected of being compromised. The analyst runs 'netstat -anp' and observes a process named 'kworker' with PID 1234 listening on TCP port 4444. The analyst knows that legitimate kworker processes are kernel threads and do not open network sockets. Which of the following conclusions is most appropriate?

Accepted Answer

The process is likely a malicious backdoor masquerading as a kernel thread, and further analysis should include checking its executable path and parent process.. A process named kworker listening on a network port is anomalous because legitimate kworker threads are kernel threads and do not open sockets. This strongly suggests a malicious process masquerading as a kernel thread. The analyst should investigate the executable path and parent process to confirm and identify the malware.

Answer

The process is a legitimate kworker that is part of a user-space threading library, which can create network sockets for inter-process communication.

Answer

The process is a legitimate kworker that has been infected by a rootkit, so the network socket is actually owned by a hidden malicious process.

Answer

The process is a legitimate kernel worker that has been temporarily repurposed by the system for network load balancing.

Question 15

An analyst observes PowerShell usage with the encoded command flag '-e'. What is the standard forensic approach to de-obfuscate and analyze this activity?

Accepted Answer

Use a base64 decoder to convert the command string to plaintext.. Base64 encoded PowerShell commands are a common tactic to bypass signature-based detection. The analyst must extract the encoded string, decode it using standard utilities like CyberChef or PowerShell itself, and then perform static analysis on the resulting script. This process is vital to understand the attacker's intent, such as identifying hidden C2 downloaders, persistence scripts, or data collection commands that were otherwise obscured from basic text-based log searches.

Answer

Run the script directly in a production environment to see its effect.

Answer

Search for the command in the Windows Update history.

Answer

Check the local BIOS/UEFI logs for the command execution.