GCFA Practice Test 20 — 15 Questions

Question 1

When performing timeline analysis on a Linux system, which file is the most critical to examine to reconstruct user login and logout history?

Accepted Answer

/var/log/wtmp. The wtmp file is the standard repository for historical login and logout data on Linux systems. By tracking session durations and connection origins, investigators can establish a user's presence during the time of an incident. This file is essential for building a reliable user-activity timeline, which provides the context needed to link specific file system changes to a particular user account or remote connection.

Answer

/var/log/syslog

Answer

/var/run/utmp

Answer

/etc/passwd

Question 2

A forensic analyst is analyzing a Windows 10 memory image and finds a process named 'svchost.exe' with PID 4567. The process's parent is 'services.exe', but its executable path is C:\Users\Public\svchost.exe. The analyst also notices that the process has a network connection to an external IP on port 443. Which of the following is the most likely explanation for this finding?

Accepted Answer

The process is a malicious executable masquerading as svchost.exe, using a legitimate parent process name and an external network connection for command and control.. A process named svchost.exe running from C:\Users\Public with a parent of services.exe and an external network connection is a classic sign of malware masquerading as a legitimate system process. The executable path is the key indicator, as legitimate svchost.exe runs from System32. The external connection suggests command and control.

Answer

The process is a legitimate svchost.exe that has been compromised via DLL hijacking, causing it to load a malicious DLL from the user directory.

Answer

The process is a legitimate svchost.exe that has been migrated to a user directory by Windows Update as part of a rollback operation.

Answer

The process is a legitimate svchost.exe instance that has been moved to a user directory by a system administrator for troubleshooting.

Question 3

During a live response on a Windows 10 workstation, you observe a process named 'lsass.exe' with PID 672. Its parent process is 'winlogon.exe' (PID 596), and its executable path is 'C:\Windows\System32\lsass.exe'. However, the process has an open handle to a suspicious named pipe '\.\pipe\evil'. Based on this evidence, what is the most likely explanation?

Accepted Answer

The process is a legitimate lsass.exe that has been compromised via a DLL injection or reflective loading technique.. The correct answer identifies that a legitimate lsass.exe with an unusual named pipe handle suggests compromise through injection or reflective loading. The process path and parent are normal, so the anomaly is the pipe, which is not part of standard lsass behavior. This indicates malicious code running within a trusted process.

Answer

The named pipe is a standard Windows component used for local security authority communication and is not suspicious.

Answer

The process is a masquerading executable placed in the System32 directory by an attacker.

Answer

The process is a child of winlogon.exe, which indicates it is a normal system process and the pipe handle is irrelevant.

Question 4

During a live response on a Windows 10 workstation suspected of lateral movement, you capture volatile memory and also export the Windows Event Logs. You need to correlate a process that was running at the time of capture with its parent process and the user account that launched it, using only the memory image. Which Volatility 3 plugin should you run to produce a parent-child process tree with PID/PPID, image name, and offset columns?

Accepted Answer

windows.pstree. The goal is a parent-child process tree with PID, PPID, and image name from a memory image. The pstree plugin is purpose-built for that: it traverses the active process list and renders indentation that shows lineage. Other plugins either list processes flatly, hunt for hidden or terminated objects, or resolve SIDs, none of which produce the tree structure required here.

Answer

windows.getsids

Answer

windows.pslist

Answer

windows.psscan

Question 5

Why is it important to include non-security personnel, such as legal counsel and HR, in the incident response process for a significant data breach?

Accepted Answer

They provide necessary oversight to ensure the company remains compliant with regulations.. Large-scale data breaches have profound legal and regulatory implications that go far beyond technical remediation. Legal counsel ensures the organization meets mandatory disclosure timelines and manages liability, while HR manages the human element, especially if the breach involved insider threats or required employee-related actions. Their involvement ensures the organization stays compliant with the law and minimizes organizational risk, which is just as vital as the technical work of stopping the attacker.

Answer

They provide technical expertise needed to reverse engineer the malware.

Answer

They are required to manually approve all firewall changes in the network.

Answer

They are responsible for conducting the forensic investigation of the servers.

Question 6

An analyst is reviewing an NTFS file system timeline and notices that a file's $STANDARD_INFORMATION modified timestamp is 2024-01-15 10:00:00, while its $FILE_NAME modified timestamp is 2024-01-15 09:55:00. The file's $MFT record shows a USN journal entry indicating a rename operation at 09:54:00. There is no other metadata. Which of the following is the most likely explanation for the 5-minute difference between the two modified timestamps?

Accepted Answer

The file was renamed at 09:54:00, which updated the $FILE_NAME timestamp to 09:55:00, and then the content was modified at 10:00:00, updating only the $STANDARD_INFORMATION timestamp.. A rename operation updates the $FILE_NAME attribute timestamps, including the modified time. Later, a content modification updates the $STANDARD_INFORMATION modified timestamp. The 5-minute difference is consistent with a rename at approximately 09:54-09:55, followed by a content modification at 10:00. The USN journal entry corroborates the rename event.

Answer

The file system was mounted with the noatime option, causing the $FILE_NAME timestamp to lag behind the $STANDARD_INFORMATION timestamp.

Answer

The $FILE_NAME modified timestamp is updated when the file's content changes, and the $STANDARD_INFORMATION modified timestamp is updated only on rename operations.

Answer

The file's content was modified at 10:00:00, and the $FILE_NAME timestamp was not updated because the file was not renamed.

Question 7

An investigator notices that a file's 'Birth' time is later than its 'Modification' time. What is the most likely forensic explanation for this phenomenon?

Accepted Answer

The file was copied from an external source. This scenario, often called 'time-traveling' files, typically occurs when a file is copied from another location. The copy process assigns a new 'Birth' time (the time of the copy), but the 'Modification' time is often preserved from the original source file. Recognizing this artifact is crucial for distinguishing between files created locally and those that were moved or copied by an attacker into the environment during an incident.

Answer

The file system is corrupted

Answer

The system clock was updated via NTP

Answer

The file is a system-level shadow copy

Question 8

An examiner is reviewing an APFS volume from a macOS 13 system. Using a timeline tool that parses APFS metadata, the analyst observes a file whose inode has an added date (birth time) earlier than its modified time, and the file's data stream shows a sparse extent. The case requires establishing the earliest credible creation time for the file. Which APFS attribute should the analyst rely on as the file's creation time?

Accepted Answer

The inode's added time (crtime) stored in the APFS inode structure. APFS stores a dedicated birth timestamp in each inode, commonly surfaced as added time or crtime, which records when the object was created. This value is maintained by the file system itself and is the correct attribute for establishing a file's creation time. Container-level times and Spotlight extended attributes describe broader or user-space state and can be misleading, while allocation extents reflect block assignment rather than object creation.

Answer

The volume superblock's last modification time for the APFS container

Answer

The data stream's first extent allocation timestamp in the APFS space manager

Answer

The extended attribute com.apple.metadata:kMDItemFSCreationDate stored on the file

Question 9

An examiner captures a memory image from a live system while a malicious process is active. Upon analysis using Volatility, the examiner notes that the process environment block (PEB) displays a different path for the executable than the one found in the VAD tree. Which artifact is likely being manipulated?

Accepted Answer

The process structures in memory. Discrepancies between the PEB and the Virtual Address Descriptor (VAD) tree often indicate process hollowing or replacement. Malware frequently updates the PEB image path to masquerade as legitimate system services while the VAD tree reflects the actual memory mapping of the injected code. Identifying this mismatch is critical for uncovering stealthy code injection techniques that bypass simple process listing tools by hiding the true origin of the executable.

Answer

The Master File Table (MFT) entry

Answer

The Thread Environment Block (TEB)

Answer

The System Service Descriptor Table (SSDT)

Question 10

A digital forensics examiner is analyzing a memory dump from a Windows 7 system using Volatility 3. The examiner wants to identify all network connections that were active at the time of the capture, including the process responsible for each connection. Which Volatility 3 plugin should the examiner use to achieve this goal?

Accepted Answer

windows.netscan. The windows.netscan plugin in Volatility 3 is specifically designed to scan memory for network connection structures and correlate them with owning processes. It provides a comprehensive view of active TCP and UDP endpoints, including local and remote addresses, ports, and process IDs. Other plugin names listed are either non-existent or less reliable, making windows.netscan the correct choice for this task.

Answer

windows.sockets

Answer

windows.netstat

Answer

windows.connections

Question 11

Which NTFS metadata file serves as the index for all files and directories on the volume?

Accepted Answer

$MFT. The Master File Table (MFT) is the central database of an NTFS volume. Every file and directory on the disk has at least one entry in the MFT. Understanding the MFT is the foundation of NTFS forensics, as it contains all the metadata necessary to identify file properties, permissions, and data locations, which are essential for rebuilding the state of the filesystem during an investigation.

Answer

$LogFile

Answer

$Boot

Answer

$Volume

Question 12

A Windows 10 endpoint was compromised, and the attacker cleared the Security event log after establishing persistence. You have a memory image captured after the clearing. Which Windows Event Log artifact can still provide evidence of the log-clearing action, even if the Security log entries were wiped?

Accepted Answer

System log Event ID 104. Clearing a log generates Event ID 1102 in the Security log and Event ID 104 in the System log. Because the Security log was erased, the 1102 entry is gone, but the System log's 104 entry usually remains and records the log name and the user who performed the clear. That surviving record is the key artifact for proving anti-forensic activity.

Answer

Security log Event ID 1102

Answer

Application log Event ID 1000

Answer

System log Event ID 6005

Question 13

A forensic analyst is examining a Windows Server 2016 memory image for evidence of a kernel-mode rootkit. The analyst runs the Volatility 3 windows.psscan plugin and observes a process named 'svchost.exe' with PID 1337 that does not appear in the windows.pslist output. Further inspection shows that the process has no corresponding entry in the active process list but has a valid EPROCESS structure in pool memory. What is the most likely explanation for this discrepancy?

Accepted Answer

The process is hidden from the active process list due to direct kernel object manipulation (DKOM) unlinking its EPROCESS from the PsActiveProcessHead list.. The discrepancy between psscan and pslist where a process appears in pool scanning but not in the active list is a hallmark of DKOM-based process hiding. Rootkits unlink the EPROCESS from the active process list to evade detection by tools that walk that list. Pool scanning finds the structure directly in memory, revealing the hidden process. This is a fundamental technique in memory forensics for detecting stealthy malware.

Answer

The process is a legitimate service host that was terminated and its EPROCESS is lingering in pool memory before being freed.

Answer

The process is a child of a protected process and is intentionally excluded from the active process list by Windows security features.

Answer

The process is a zombie process that has been reaped by its parent but its EPROCESS remains in memory due to a handle leak.

Question 14

What is the primary purpose of the $LogFile in NTFS?

Accepted Answer

To prevent filesystem corruption.. The $LogFile is essential for maintaining NTFS consistency. It records all metadata changes before they are committed, allowing the system to recover from crashes by rolling back or completing interrupted operations. While the $LogFile is circular and does not store user data, its entries can often reveal the order of operations, helping an investigator reconstruct the sequence of events leading up to a system compromise.

Answer

To track user login history.

Answer

To store backup copies of files.

Answer

To record all file access logs.

Question 15

When analyzing a memory dump, what is the primary purpose of identifying the 'KPCR' (Kernel Processor Control Region)?

Accepted Answer

To find the current thread context.. The KPCR is a structure containing critical processor-specific information, including the current thread and CPU state. It is vital for forensic analysts because it serves as the anchor for finding the current thread of execution on each core. Understanding the KPCR helps analysts reconstruct the execution context, which is essential for identifying which threads were running at the moment of capture, especially during complex multi-threaded attacks.

Answer

To identify all running processes.

Answer

To map virtual addresses to physical pages.

Answer

To reset kernel-mode security policies.