GCFA Practice Test 17 — 15 Questions

Question 1

Which forensic artifact is most useful for determining if a user has recently opened a specific suspicious file, even if that file has since been deleted?

Accepted Answer

Windows LNK files and Jump Lists.. Shell items, specifically LNK files and Jump Lists, maintain metadata about user file interactions. When a user opens a file, the OS creates these artifacts, which persist even if the target file is removed. This makes them essential for identifying user intent and proving that a malicious file was not only present but was actively accessed by the user, providing critical evidence for attribution.

Answer

The Windows Registry SAM hive.

Answer

System event logs (Event ID 7045).

Answer

The browser cache database.

Question 2

When analyzing the $LogFile in NTFS, what is the significance of the undo and redo operations recorded in the transaction logs for timeline reconstruction?

Accepted Answer

They provide a sequential record of metadata changes.. The $LogFile is a circular buffer that records metadata transactions to ensure file system consistency. Redo operations replay actions to restore state after a crash, while undo operations revert changes. For a forensic analyst, these logs are vital because they capture the 'before' and 'after' state of MFT entries, providing a granular history of file system modifications that occur faster than standard logging frequencies.

Answer

They enable the recovery of deleted file content.

Answer

They are only used by the OS for chkdsk recovery.

Answer

They only record changes to the root directory index.

Question 3

An analyst is examining a memory capture to identify malicious code injection. Which volatility plugin would best help determine if a process has been hollowed by inspecting the base address and the VAD (Virtual Address Descriptor) properties of the memory segments?

Accepted Answer

malfind. The malfind plugin is the standard tool for identifying injected code by scanning for memory segments with Execute/Read/Write permissions that are not backed by a file on disk. This is a critical step in volatile memory analysis because malware often uses process hollowing to hide its execution flow within legitimate system processes. Comparing VAD protections helps confirm the anomaly, which is a hallmark of sophisticated persistent threats evading standard file-based detection.

Answer

pslist

Answer

handles

Answer

pstree

Question 4

An organization is deploying an EDR solution across a hybrid environment. Which TWO of the following tasks are critical for ensuring effective incident response visibility?

Accepted Answer

Configuring full-stack telemetry collection across all managed endpoints.. Successful EDR deployment requires both technical configuration and operational integration. Ensuring comprehensive coverage across all endpoints prevents blind spots where attackers can hide, while defining automated response playbooks allows the IR team to scale their efforts during high-velocity incidents. These tasks are foundational to reducing mean time to respond, as they ensure high-fidelity telemetry is available and actionable, allowing for rapid containment of threats before they escalate across the enterprise network.

Answer

Excluding all antivirus-flagged files from the EDR scanning scope.

Answer

Disabling kernel-mode auditing to improve endpoint performance metrics.

Answer

Restricting data retention to 24 hours to comply with privacy regulations.

Question 5

An analyst identifies a process performing unexpected DNS queries to a top-level domain ending in .xyz every 60 seconds. What is the most effective initial host-based action to confirm malicious beaconing?

Accepted Answer

Correlate the DNS query timestamps with socket ownership via netstat or EDR telemetry.. Isolating the process behavior through network connection correlation allows the analyst to map the C2 traffic to a specific binary. Identifying the parent process and local socket ownership is essential to distinguish between legitimate background tasks and automated beaconing activity. This helps narrow the scope of the investigation by confirming the persistence mechanism and the specific threat actor communication pattern associated with the compromised host.

Answer

Perform a full disk imaging of the host immediately.

Answer

Execute an immediate reboot of the affected system.

Answer

Flush the local DNS resolver cache on the host.

Question 6

What is the primary function of the $LogFile in NTFS when reconstructing a timeline?

Accepted Answer

To record metadata transactions for file system integrity. The $LogFile is a circular buffer that records metadata transactions for the file system. It is invaluable for forensic analysts because it captures recent changes to the file system, including those that might not yet be committed to the MFT. By parsing the $LogFile, investigators can recover evidence of file creations, deletions, or renames that occurred shortly before an incident, providing a granular view of recent activity that might otherwise be lost.

Answer

To store the actual file content data for quick retrieval

Answer

To track all user-level file access and modification events

Answer

To store backup copies of the Master File Table

Question 7

What is the significance of the $LogFile in NTFS when performing an investigation on a system that experienced a sudden power loss?

Accepted Answer

It records transaction metadata for crash recovery.. The $LogFile is a circular buffer that records metadata operations before they are finalized. When a system crashes or loses power, the NTFS driver uses the $LogFile upon reboot to replay or undo incomplete transactions, ensuring volume consistency. For investigators, it provides a window into the state of the filesystem immediately before the crash, potentially recovering records of files modified just before the power failure.

Answer

It stores user credentials for encrypted sessions.

Answer

It keeps a copy of all deleted file contents.

Answer

It is used by BitLocker to verify volume integrity.

Question 8

During a cloud-based incident, you determine that an attacker has gained access to an IAM role with excessive permissions. What is the most effective containment step to minimize the blast radius without causing immediate service outages?

Accepted Answer

Attach an inline policy to deny all actions for the compromised role.. In cloud environments, the most precise way to contain an identity-based attack is to apply an inline policy to the compromised role that explicitly denies all actions, or to revoke the active session tokens. By narrowing the scope of permissions or invalidating current credentials, responders can prevent the attacker from performing further unauthorized API calls while allowing legitimate, non-impacted services to continue functioning correctly within the environment.

Answer

Delete the IAM role immediately.

Answer

Change the password for the root user account.

Answer

Disable the entire cloud subscription or account.

Question 9

A forensic analyst captures a memory image from a Windows 10 workstation using a hardware acquisition tool. The analyst then wants to enumerate the loaded kernel modules to compare against a known-good baseline. Which Volatility 3 plugin should the analyst run to list the loaded kernel modules from the memory image?

Accepted Answer

windows.modules. The windows.modules plugin is designed to enumerate loaded kernel modules from a Windows memory image, providing a list of drivers and their base addresses. This is essential for comparing against a known-good baseline to identify unauthorized or malicious kernel modules. The other plugins target process lists, DLLs within processes, or handles, none of which directly provide a system-wide kernel module enumeration.

Answer

windows.dlllist

Answer

windows.handles

Answer

windows.pslist

Question 10

Which phase of the incident response lifecycle is most directly responsible for ensuring that an enterprise environment is returned to a secure, verified state after an intrusion?

Accepted Answer

Recovery. The recovery phase is where the focus shifts from stopping the bleeding to restoring business operations securely. This involves verifying that all backdoors have been closed, credentials have been rotated, and systems are patched against the initial vulnerability used by the attacker. Without rigorous verification in this phase, the enterprise remains vulnerable to reinfection, as attackers often leave dormant persistence mechanisms that can be triggered if the remediation is not thorough.

Answer

Identification

Answer

Containment

Answer

Lessons Learned

Question 11

When analyzing memory for evidence of code injection, which THREE of the following memory regions or indicators are most significant to investigate?

Accepted Answer

Memory segments marked as PAGE_EXECUTE_READWRITE. Code injection often involves modifying existing memory segments or creating new ones with abnormal permissions. Analysts must look for areas of memory that are marked as executable but do not map to a file on disk (private memory), detect hooks in common system libraries, or identify discrepancies between memory-resident code and the original binary on disk. These indicators are classic signs that a process has been tampered with to execute malicious logic.

Answer

The presence of standard DLLs in the loading list

Answer

The thread environment block (TEB) memory region

Question 12

An investigator is analyzing MACB timelines on a Windows system and needs to differentiate between a file being copied versus being moved within the same NTFS volume. Which timeline artifact behavior distinguishes an intra-volume file move from a file copy operation?

Accepted Answer

An intra-volume move updates the parent directory index while preserving the original $MFT record's creation timestamp, whereas a copy generates a new $MFT record with a new creation time.. Differentiating file movement from copying is essential for tracking data exfiltration and staging on a compromised system. Within the same NTFS volume, a move operation retains the original $MFT record and updates directory pointers, whereas copying creates an entirely new $MFT record with fresh creation timestamps, providing a clear footprint in timeline analysis.

Answer

An intra-volume move operation creates a brand-new $MFT record with current creation timestamps, while a copy preserves the original record.

Answer

Both operations generate identical $MFT records because NTFS abstracts file movement as a symbolic link creation process.

Answer

A file copy updates the $STANDARD_INFORMATION attribute while leaving $FILE_NAME untouched, whereas a move updates both simultaneously.

Question 13

Which of the following is true regarding the 'MFT Change' timestamp?

Accepted Answer

It tracks when the file metadata was last modified.. The 'MFT Change' (or 'Entry Modified') timestamp is updated whenever the metadata of the file record itself is changed, such as by moving the file, renaming it, or changing its permissions. Unlike the 'Modified' timestamp, which tracks file content changes, the MFT change timestamp is exclusively tied to the record metadata. This makes it a unique indicator for tracking structural changes to a file that may be missed if looking only at content modification times.

Answer

It is updated whenever the file's content changes.

Answer

It is easily modified by standard user applications.

Answer

It is identical to the file's creation time.

Question 14

An incident responder acquires a memory image from a compromised Windows 10 workstation using an aggressive kernel-level driver acquisition tool. Upon analyzing the image with Volatility 3, the analyst notices that several critical system processes are completely missing from the process list traversal. Which underlying mechanism best explains why these processes are absent from the standard doubly-linked list traversal?

Accepted Answer

The malware executed direct kernel object manipulation to remove the process entries from the active process doubly-linked list.. Standard process enumeration in Volatility relies on traversing the ActiveProcessLinks doubly-linked list rooted in the PsActiveProcessHead pointer. Advanced malware frequently unlinks EPROCESS structures from this list via direct kernel object manipulation to evade standard task manager visibility. Analysts must utilize kernel pool scanning plugins like pslist alternatives to recover these hidden entries.

Answer

The memory acquisition tool utilized an unprivileged user-mode API that restricted kernel visibility.

Answer

The operating system automatically paged the missing process control blocks out to the swap file during memory dumping.

Answer

Volatility 3 requires an outdated symbol table to correctly resolve the exact offsets of the Windows 10 kernel structures.

Question 15

Which log category should an analyst examine to identify a potential 'Pass-the-Hash' attack?

Accepted Answer

Security event logs for Event ID 4624.. Pass-the-Hash attacks involve an attacker using an NTLM hash to authenticate as a user without the cleartext password. This typically manifests in the Security event log during the authentication process. By looking for specific logon types and unusual source-to-destination authentication flows, analysts can detect when a hash has been reused across the network, even if the attacker never obtained the actual password through brute force or phishing.

Answer

System event logs for service failures.

Answer

Application event logs for crash dumps.

Answer

DNS query logs from the domain controller.