GCFA Practice Test 2 — 10 Questions

Question 1

An analyst is building a file system timeline from an NTFS volume and is deciding which timestamps to extract from the $STANDARD_INFORMATION attribute. A colleague suggests that the four timestamps in $STANDARD_INFORMATION are the only relevant times. Which statement correctly describes the relationship between $STANDARD_INFORMATION and $FILE_NAME timestamps?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME each contain four timestamps, and comparing them can reveal timestamp manipulation or file moves.. NTFS stores timestamps in both the $STANDARD_INFORMATION and $FILE_NAME attributes of an MFT record. The two sets are maintained by different mechanisms and can disagree, which is itself valuable evidence. An analyst should extract both and compare them rather than relying on a single source, because the discrepancies often indicate moves, renames, or deliberate timestamp alteration.

Answer

$STANDARD_INFORMATION timestamps are always more reliable than $FILE_NAME timestamps and should be used exclusively.

Answer

$FILE_NAME timestamps are only populated when a file is created and never change afterward.

Answer

$FILE_NAME timestamps are duplicates of $STANDARD_INFORMATION and can be ignored.

Question 2

An analyst is investigating a Windows 10 system and wants to determine the last time a specific user logged on interactively. The analyst has access to the Security event log. Which event ID should the analyst examine to find this information?

Accepted Answer

4624. Event ID 4624 is the primary event for successful logons. It contains detailed information including the logon type, which distinguishes interactive (type 2 or 10) from network (type 3) or other logons. By filtering for the specific user account and logon types 2 and 10, the analyst can identify the most recent interactive logon. This is a standard technique in Windows forensic analysis.

Answer

4625

Answer

4647

Answer

4634

Question 3

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 4

An investigator analyzing an NTFS volume notices that a file's $STANDARD_INFORMATION MACB timestamps significantly differ from its $FILE_NAME timestamps. The $FILE_NAME modification time predates the $STANDARD_INFORMATION modification time. What is the most reliable forensic interpretation of this discrepancy?

Accepted Answer

The file was likely subjected to time-stomping where user-space tools altered the $STANDARD_INFORMATION attributes, leaving the original $FILE_NAME timestamps intact.. Timestamp discrepancies between the $STANDARD_INFORMATION and $FILE_NAME attributes often indicate file manipulation, copying, or time-stomping. Since the $STANDARD_INFORMATION attribute can be easily modified by user-space APIs while the $FILE_NAME attribute is managed directly by the NTFS driver, comparing both provides crucial insight into anti-forensic activities and accurate timeline reconstruction during incident response investigations.

Answer

The file was compressed using NTFS compression, which automatically updates the $STANDARD_INFORMATION modification timestamp while leaving $FILE_NAME untouched.

Answer

An automated defragmentation utility ran on the volume, updating the high-level metadata without altering the underlying filename structure.

Answer

The operating system experienced an unclean shutdown, causing the lazy writer thread to flush $STANDARD_INFORMATION changes out of synchronization with $FILE_NAME.

Question 5

An incident responder is preparing to acquire a forensic image of a running Windows server that is suspected of being compromised. The server hosts a critical database that cannot be taken offline. Which method is most appropriate for acquiring the disk image while minimizing disruption?

Accepted Answer

Use a live acquisition tool like FTK Imager or Magnet ACQUIRE to create a forensic image of the disk while the system is running.. For a running server that cannot be taken offline, live acquisition with a tool like FTK Imager or Magnet ACQUIRE is the best option. These tools create a forensic image of the disk while the system is operational, preserving the data with minimal disruption. However, they should be used in conjunction with volatile data collection to capture memory and network state.

Answer

Use a hardware write blocker and remove the disk to image it on a separate workstation.

Answer

Run the built-in Windows backup utility to create a system image to a network share.

Answer

Use diskpart to create a shadow copy and then copy the volume to an external drive.

Question 6

Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?

Accepted Answer

It holds the metadata for all files on the volume.. The MFT is the central database of an NTFS volume. It stores metadata for every file and directory on the disk, including file names, sizes, timestamps, and data runs. For forensic analysts, the MFT is the most important artifact, as it provides a comprehensive map of all files, including deleted ones, allowing for the reconstruction of the file system and identification of malicious files that were intentionally erased by an adversary.

Answer

It is an application log that tracks system crashes.

Answer

It stores user credentials for encrypted files.

Answer

It is only used to store files larger than 1GB.

Question 7

An incident responder is analyzing a memory image from a Windows 10 system that is suspected of being infected with a fileless malware. The responder runs the Volatility 3 windows.malfind plugin and observes several memory regions with PAGE_EXECUTE_READWRITE protection and a MZ header. However, the responder notices that some of these regions are backed by a file on disk, while others are not. Which of the following conclusions is most appropriate regarding the unbacked regions?

Accepted Answer

The unbacked regions are indicative of injected code or shellcode, as they do not correspond to any file on disk and have suspicious permissions.. In memory forensics, unbacked memory regions with PAGE_EXECUTE_READWRITE protection and executable content such as an MZ header strongly suggest injected code or shellcode. Legitimate code is typically backed by a file on disk via a mapped section. The lack of file backing means the code was likely written directly into the process's address space by an injection technique, a common characteristic of fileless malware. This finding should prompt further extraction and analysis of the injected payload.

Answer

The unbacked regions are likely legitimate DLLs loaded from disk but with modified permissions due to process hardening.

Answer

The unbacked regions are artifacts of the Volatility plugin itself, which may incorrectly report memory as unbacked due to parsing errors.

Answer

The unbacked regions are likely due to memory compression or paging, where the file backing was temporarily removed from the working set.

Question 8

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable. The analyst wants to determine whether the executable was actually executed on the system. Which additional artifact should the analyst examine to confirm execution?

Accepted Answer

Prefetch files. Prefetch files are created by the Windows Cache Manager when an executable is run, recording the execution time and run count. This directly confirms execution. ShimCache only shows that a file was present and may have been executed, so Prefetch is the best additional artifact to verify execution. Amcache, UserAssist, and SRUM may provide supporting evidence but are not as definitive or comprehensive for this purpose.

Answer

SRUM (System Resource Usage Monitor)

Answer

Amcache.hve

Answer

UserAssist

Question 9

A forensic analyst is examining a memory dump from a Windows 10 system that is suspected of being infected with a rootkit that hides its presence by unlinking its process from the active process list. The analyst runs Volatility 3 and compares the output of the windows.pslist and windows.psscan plugins. Which of the following best describes the expected discrepancy between these two plugins in the presence of such a rootkit?

Accepted Answer

windows.psscan will show more processes than windows.pslist because it can detect processes that have been unlinked from the active process list.. windows.pslist enumerates processes by following the active process list, which a rootkit can manipulate by unlinking its process. windows.psscan, however, scans memory for process objects using pool tags, which does not rely on the list. Therefore, in the presence of a process-unlinking rootkit, windows.psscan will detect the hidden process, resulting in a higher process count compared to windows.pslist. This discrepancy is a key indicator of hidden processes.

Answer

windows.pslist will show more processes than windows.psscan because it includes terminated processes that are still in memory.

Answer

Both plugins will show the same number of processes because they both use the same underlying data structure.

Answer

windows.psscan will show fewer processes than windows.pslist because it relies on a linked list that the rootkit modifies.

Question 10

An analyst is examining a memory image from a Windows 10 system that is suspected of being infected with malware that uses process hollowing. The analyst wants to identify processes that may have been hollowed. Which TWO of the following artifacts or techniques are most indicative of process hollowing? (Choose two.)

Accepted Answer

The process's image path in memory does not match the file path on disk.. Process hollowing involves creating a legitimate process in a suspended state, unmapping its memory, and injecting malicious code. This results in two key indicators: the in-memory image path may not match the disk file (or the memory content differs from disk), and threads execute from memory regions not backed by a file. These artifacts are directly tied to the hollowing technique and are detectable through memory analysis.

Answer

The process's token indicates it is running with elevated privileges.

Answer

The process's parent process ID (PPID) is a non-existent process.

Answer

The process has a large number of open handles to remote named pipes.