GCFA Practice Test 19 — 15 Questions

Question 1

An analyst acquires a forensic image of a Windows 10 NTFS volume using a write blocker and now needs to build a file system timeline. The analyst wants to include the $STANDARD_INFORMATION timestamps but also wants to detect timestomping by comparing them with the $FILE_NAME timestamps. Which tool should the analyst use to extract both timestamp sets from the MFT and generate a bodyfile for timeline creation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MFTECmd. MFTECmd is specifically designed to parse the $MFT and output both $STANDARD_INFORMATION and $FILE_NAME timestamps, enabling direct comparison for timestomping detection. The other tools either do not extract both timestamp sets or are not intended for this purpose.

Answer

ntfs-3g

Answer

log2timeline.pl

Answer

fls from The Sleuth Kit

Question 2

A forensic examiner is analyzing a memory image from a Windows 7 system that is suspected of being compromised by a sophisticated rootkit. The examiner runs the Volatility 2 plugin 'ssdt' and notices that several system service dispatch table (SSDT) entries point to addresses within a kernel module that is not signed by Microsoft and is not present in the loaded module list. Which of the following best describes the rootkit technique that is most likely in use?

Accepted Answer

SSDT hooking, where the rootkit replaces the function pointers in the SSDT to redirect system calls to its own malicious functions.. The SSDT contains pointers to kernel functions for system services. If entries point to an unsigned module not in the loaded module list, it indicates that the SSDT has been hooked—modified to redirect system calls to malicious code. This is a classic rootkit technique to intercept and manipulate system calls, allowing the rootkit to hide its presence and activities. Inline hooking and IAT hooking affect different structures, and DKOM does not apply to the SSDT in this manner.

Answer

Import Address Table (IAT) hooking, where the rootkit modifies the IAT of user-mode processes to redirect API calls to its own code.

Answer

Inline hooking of the SSDT functions, where the rootkit overwrites the first bytes of the legitimate functions with a jump to its own code.

Answer

DKOM on the SSDT, where the rootkit unlinks the SSDT from the kernel's list of service tables to hide its modifications.

Question 3

Which of the following describes the purpose of the 'Object Header' in Windows memory forensics?

Accepted Answer

It contains metadata like reference counts and types. The Object Header precedes the body of every object managed by the Windows kernel, such as processes, threads, or files. It contains critical metadata, including the object type, reference count, and security descriptor. For forensic analysts, this header provides vital information about the object's lifespan and permissions, which is crucial for identifying unauthorized access or tracking the lifecycle of malicious objects within the kernel's memory management system.

Answer

It stores the process command line arguments

Answer

It is used for memory page table translations

Answer

It provides a mapping for disk-based sectors

Question 4

You are analyzing a Windows 10 memory dump for evidence of a kernel-mode rootkit that may have unlinked a malicious driver from the active module list. Which two Volatility 3 plugins would you use together to detect and enumerate such a hidden driver? (Choose two.)

Accepted Answer

windows.modscan. To detect a driver that has been unlinked from the active module list, you need plugins that scan kernel pool memory for driver-related structures. windows.modscan finds module structures, and windows.driverscan finds driver objects. Together they can reveal a hidden driver that a rootkit has unlinked. The other plugins either list only active modules, focus on IRP hooking, or enumerate callbacks, none of which directly detect unlinked drivers.

Answer

windows.driverirp

Answer

windows.callbacks

Answer

windows.modules

Question 5

What is the primary function of the $LogFile in an NTFS file system?

Accepted Answer

To support file system recovery and consistency.. The $LogFile is a circular buffer used to ensure file system consistency, particularly during system crashes. It records metadata transactions, allowing the system to roll back or finish operations that were interrupted. For forensic analysts, the $LogFile acts as a record of 'in-progress' operations that may not have been committed to the MFT yet, providing an essential look into very recent system activity that is otherwise invisible in standard MFT analysis.

Answer

To store user authentication logs.

Answer

To track file access by unauthorized users.

Answer

To store the contents of deleted files.

Question 6

A forensic analyst is examining a Windows 10 memory image to identify potential process injection. The analyst runs Volatility 3 plugins and focuses on the windows.malfind output. Which two of the following characteristics are most indicative of malicious code injection in a process's memory space? (Choose two.)

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE protection that contains a MZ header but has no corresponding file path in the VAD.. Indicators of process injection include memory regions with PAGE_EXECUTE_READWRITE protection that are unbacked by a file on disk, especially when they contain executable headers like MZ. These characteristics suggest that code was injected directly into the process's address space, bypassing normal module loading. Legitimate code is usually backed by files and has more restrictive permissions. Therefore, the combination of RWX permissions and lack of file backing is a key red flag.

Answer

A memory region containing a PE header (MZ) that matches a known legitimate system DLL on disk.

Answer

A memory region with PAGE_READONLY protection that contains configuration data.

Answer

A memory region with PAGE_EXECUTE_READ protection that is backed by a signed Microsoft DLL.

Question 7

A forensic analyst is investigating a system where a user is suspected of using a tool to hide files by manipulating NTFS metadata. The analyst finds an MFT entry with a $FILE_NAME attribute that has a namespace value of 2 (POSIX) and a $STANDARD_INFORMATION attribute with timestamps that are inconsistent with the file's $UsnJrnl records. Which conclusion is most appropriate regarding the file's naming and timestamp artifacts?

Accepted Answer

The POSIX namespace suggests the file name contains characters that are not allowed in the Win32 namespace, and the timestamp inconsistency may indicate the file was moved or its timestamps were altered.. The POSIX namespace in NTFS is used for file names that are valid in POSIX but not in the Win32 namespace, such as those ending with a space or period. Attackers can use such names to hide files from typical Windows tools. The inconsistency between $STANDARD_INFORMATION timestamps and $UsnJrnl records suggests the $STANDARD_INFORMATION timestamps may have been manipulated, a common anti-forensic technique. Analysts should correlate these artifacts to detect hidden or altered files.

Answer

The POSIX namespace indicates the file was created by a POSIX-compliant application, and the timestamp inconsistency is likely due to time zone differences.

Answer

The POSIX namespace is used for files that are encrypted with EFS, and the timestamp inconsistency indicates the file was recently decrypted.

Answer

The POSIX namespace indicates the file is a hard link, and the timestamp inconsistency is due to the link being created at a different time than the original file.

Question 8

What is the consequence of a file name being stored in the $FILE_NAME attribute but not in the $INDEX_ROOT of its parent directory?

Accepted Answer

The file is an orphaned file.. If a file name exists in the $FILE_NAME attribute but not in the parent directory's $INDEX_ROOT, the file is 'orphaned'. It remains present on the disk in the MFT but is invisible to the OS and users via standard directory navigation. This is a common indicator of a partially successful deletion or a file system error that removed the directory link.

Answer

The file is encrypted with BitLocker.

Answer

The file is a system-hidden file.

Answer

The file is a compressed sparse file.

Question 9

When investigating a suspected data exfiltration incident, which TWO sources are most useful for determining the volume and destination of the transferred data?

Accepted Answer

Network flow (NetFlow) logs.. Firewall logs and NetFlow data are the most reliable sources for quantifying data exfiltration. Firewall logs provide information about the connections made, while NetFlow provides the volume of data transferred between specific source and destination IPs. By analyzing these, an analyst can pinpoint the exact amount of data that left the network and where it was sent, which is crucial for reporting the incident's impact and determining the nature of the breached data.

Answer

Application performance monitoring (APM) logs.

Answer

Endpoint antivirus event logs.

Answer

Active Directory authentication logs.

Question 10

Which NTFS metadata attribute is responsible for storing Security Descriptors (ACLs)?

Accepted Answer

$SECURITY_DESCRIPTOR. The $SECURITY_DESCRIPTOR attribute contains the Access Control List (ACL) information for a file, which determines which users or groups can access it. Forensic analysts frequently examine this to identify if permissions have been modified to allow unauthorized access or if a sensitive file has had its permissions altered to hide it from standard administrative users on the system.

Answer

$FILE_NAME

Answer

$ATTRIBUTE_LIST

Answer

$DATA

Question 11

An analyst is examining a file that was deleted. Why is the 'File Name' (FN) attribute in the MFT still potentially readable?

Accepted Answer

NTFS does not zero out MFT records upon deletion.. When a file is deleted in NTFS, the MFT record is marked as free, but the data within the record is not immediately wiped or zeroed. The FN attribute remains in the MFT entry until the record is reallocated to a new file. This is a critical forensic detail because it allows analysts to recover metadata from deleted files, often providing the only remaining evidence of a file's existence after the data clusters have been overwritten.

Answer

The MFT entry is locked by the OS kernel.

Answer

The file was stored on a compressed volume.

Answer

The entry is hard-linked to another file.

Question 12

During an investigation of a Windows Server 2019 host, you review the Security event log and find Event ID 4624 entries with Logon Type 3 originating from a workstation subnet that should never authenticate to this server. The associated 4672 entry shows SeDebugPrivilege assigned to the resulting token. The account name is a normal helpdesk user. Which conclusion is most defensible from these artifacts alone?

Accepted Answer

The helpdesk account authenticated over the network and received administrator-level privileges in that session.. A Logon Type 3 combined with Event 4672 indicates a network authentication that received special privileges, which is the classic signature of remote administrative access using a nominally low-privilege account. The unauthorized source subnet makes this more suspicious rather than less. Investigators should follow the source IP back to the originating host and check for credential theft or lateral movement tooling there.

Answer

The server was rebooted and the helpdesk account was used as a service account during startup.

Answer

The helpdesk account performed an interactive RDP session to the server from the workstation subnet.

Answer

The account was used to start a scheduled task on the server, which explains the privileged token.

Question 13

When reviewing firewall logs, what activity should be flagged as an immediate indicator of a potential port scan?

Accepted Answer

A high frequency of connection attempts from one source to many destination ports.. A port scan involves a single source IP attempting to connect to a large range of destination ports in a short timeframe. Firewall logs showing a spike in 'Denied' or 'Dropped' connection attempts from one host to many different targets is a classic signature. Identifying this helps analysts catch reconnaissance activity early before the attacker transitions to active exploitation of a specific vulnerable service.

Answer

Multiple successful inbound connections to port 80.

Answer

A single connection to a database port from an internal host.

Answer

Periodic outbound traffic to a known DNS server.

Question 14

During an intrusion investigation on a Windows 10 workstation, an analyst observes that several user-mode processes have established TCP connections to 203.0.113.45:443. The analyst wants to determine which executable image on disk was responsible for the network activity and whether the process is still running. Which artifact provides the most direct evidence by mapping a live network connection to its owning process executable path?

Accepted Answer

Sysmon Event ID 3 (Network connection detected) with the Image and DestinationIp fields. Sysmon Event ID 3 is specifically designed to log network connection events and includes the full image path of the process that initiated the connection, along with source and destination IP/port. This allows an analyst to definitively map a connection to an executable on disk and determine if that process was running at the time of the event. Other artifacts either lack process attribution, are non-persistent, or do not record the executable path in a usable form for this correlation.

Answer

Security event log 5156 (Windows Filtering Platform permitted a connection) filtered by destination IP

Answer

Windows Firewall log entries recording allowed outbound connections to the remote IP

Answer

Netstat output showing the PID and remote address, correlated with Task Manager

Question 15

When examining a memory image, why is it necessary to ensure that the profile used for the memory analysis tool matches the target operating system's specific build?

Accepted Answer

To determine the correct offsets for kernel data structures. Kernel data structures, such as the EPROCESS list or the KPCR, change in offset and size between different OS builds and service packs. If an incorrect profile is used, the analysis tool will misinterpret these structures, leading to incorrect process listing, failed memory mapping, or complete analysis failure. Using the correct profile ensures that the tool accurately maps the memory layout according to the specific kernel offsets of the target system.

Answer

To ensure the memory image is encrypted correctly

Answer

To increase the speed of the memory dumping process

Answer

To bypass the system's kernel-mode security drivers