GCFA Practice Exam 2 — 20 Questions

Question 1

During memory analysis of a Windows host, an examiner runs windows.netscan and observes several established TCP connections originating from a process that no longer appears in the process list. Which conclusion is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The connections are likely residual artifacts from a terminated process, and the examiner should correlate timestamps and process IDs to confirm.. windows.netscan can surface network structures that outlive their owning process, so missing process entries alongside established connections often reflect terminated processes rather than hidden malware. Correlating process IDs, timestamps, and other artifacts is the proper next step. Claiming rootkit activity, image corruption, or a confirmed attack from this observation alone is premature and unsupported.

Answer

The connections are proof of a network-based attack and should be reported as a confirmed incident.

Answer

The connections indicate that the memory image is corrupted and should be reacquired.

Answer

The connections prove that a rootkit is hiding a running process from the process list.

Question 2

When reviewing Jump Lists on a Windows system, which file extension is commonly associated with the 'AutomaticDestinations' folder?

Accepted Answer

.automaticDestinations-ms. Jump Lists, located in the AutomaticDestinations and CustomDestinations folders, track recently accessed files and applications. The files are identified by an AppID, which is a hash of the application's path. These files often end with the .automaticDestinations-ms extension. They are vital for identifying files opened by users, providing insight into document access, media playback, and tool usage that may relate to intellectual property theft or evidence of work.

Answer

.pf

Answer

.log

Answer

.lnk

Question 3

An analyst is triaging a Windows 10 workstation suspected of a fileless malware infection. The analyst needs to quickly identify whether a specific process has an injected thread by examining volatile memory. Which Volatility 3 plugin should be used to list threads and their associated start addresses for a given process?

Accepted Answer

windows.threads. The windows.threads plugin enumerates threads within a process, showing start addresses that can be compared against known module ranges. Injected threads often have start addresses in unbacked memory, making this plugin ideal for detecting code injection. The other plugins focus on memory regions, handles, or loaded modules, none of which provide thread-level detail needed to identify an injected thread.

Answer

windows.dlllist

Answer

windows.handles

Answer

windows.malfind

Question 4

During a live response on a Windows 10 workstation suspected of malware infection, an examiner captures a full physical memory image using WinPmem. The examiner later wants to determine whether the captured image contains enough context to reconstruct which user account was interactively logged on at the time of acquisition. Which memory structure would the examiner primarily parse to identify the active interactive session and its associated user?

Accepted Answer

The token object referenced by explorer.exe, because its user SID identifies the interactively logged-on account.. The interactive user's identity is tied to the token of a process running in that user's session, such as explorer.exe. Extracting the token SID from explorer.exe's EPROCESS in the memory image confirms which account was interactively logged on. Other structures like KDBG or winlogon's EPROCESS do not directly hold the interactive user SID, making them unsuitable for this specific attribution.

Answer

The KDBG structure, because it stores the list of logged-on user sessions and their SIDs.

Answer

The EPROCESS block for winlogon.exe, because it stores the Security Identifier (SID) of the interactive user.

Answer

The PEB of lsass.exe, because it caches the credentials of the interactive user in plaintext.

Question 5

When identifying a hidden process via a cross-view analysis, which memory structure is most reliable to compare against the EPROCESS list?

Accepted Answer

The thread list in the scheduler. Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Answer

The Master File Table (MFT)

Answer

The user-mode Process Environment Block (PEB)

Answer

The System Service Descriptor Table (SSDT)

Question 6

Which TWO of the following are considered reliable methods for detecting hidden processes in memory forensics?

Accepted Answer

psscan pool tag analysis. Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

Answer

pslist enumeration

Answer

Task Manager API polling

Answer

Registry hive parsing

Question 7

An enterprise incident response team is preparing to contain a confirmed ransomware outbreak that has already encrypted several file servers. The team must preserve forensic evidence while stopping further spread. Which two actions best balance evidence preservation with containment in this scenario? (Choose two.)

Accepted Answer

Isolate affected servers from the network at the switch or EDR level while keeping them powered on. Isolating affected servers at the network layer stops the spread without destroying volatile evidence, and capturing memory before containment preserves fragile artifacts such as encryption keys and active processes. Together they satisfy containment and preservation. Powering off, reimaging, or deleting files would destroy evidence or recovery options and do not represent a balanced response.

Answer

Reimage all affected servers immediately to restore business operations

Answer

Immediately power off all affected servers to halt encryption activity

Answer

Delete all encrypted files to prevent the ransomware from spreading further

Question 8

An incident responder is reviewing logs from a compromised Linux server and notices a large number of failed SSH login attempts from a single external IP address, followed by a successful login. Which of the following best describes this activity?

Accepted Answer

A brute-force attack that resulted in unauthorized access.. The sequence of numerous failed SSH logins from a single external IP followed by a successful login is a classic indicator of a brute-force attack that succeeded. This constitutes unauthorized access and requires immediate incident response actions, including isolating the server, investigating the attacker's activities, and resetting compromised credentials.

Answer

A misconfigured SSH client repeatedly attempting to authenticate with an expired key.

Answer

A denial-of-service attack that overwhelmed the SSH service.

Answer

A legitimate user who forgot their password and eventually guessed it correctly.

Question 9

A GCFA analyst is investigating a Windows Server 2019 system that was compromised via a PowerShell-based attack. The analyst has a memory image and the Windows event logs. The analyst wants to determine the exact PowerShell script block that was executed by a suspicious process. Which artifact or log source would provide the most direct evidence of the script block content?

Accepted Answer

Windows PowerShell event log, event ID 4104 (Script Block Logging).. Script Block Logging (event ID 4104) captures the actual PowerShell code that runs, including obfuscated or dynamically constructed script blocks, and writes it to the Windows PowerShell operational log. This is the most direct artifact for determining what a malicious PowerShell script did. Command-line auditing and memory plugins can show how PowerShell was launched but not the full script content. Therefore, the PowerShell event log with 4104 is the best source.

Answer

The windows.cmdline plugin output from the memory image showing the PowerShell process command line.

Answer

Windows Security event log, event ID 4688 (Process Creation) with command-line auditing enabled.

Answer

The windows.pslist plugin output showing the PowerShell process and its parent process.

Question 10

In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?

Accepted Answer

The discrepancy between the system clock and the actual time. Time skew is the difference between the actual wall-clock time and the time reported by the system under investigation. Identifying and correcting for this skew is a fundamental prerequisite for timeline analysis. If the investigator ignores the skew, all events will be chronologically misaligned, making it impossible to correlate evidence across different machines or correlate logs with file system activity during the incident reconstruction phase.

Answer

The difference between local time and UTC

Answer

The intentional modification of a file's timestamp

Answer

The process of normalizing timestamps to a common format

Question 11

During a memory forensics investigation, an analyst uses Volatility 3 to examine a Windows 10 memory image. The analyst runs the windows.malfind plugin and observes a memory region with PAGE_EXECUTE_READWRITE protection that contains a PE header and is not backed by a file on disk. The region is associated with a process named explorer.exe. Which of the following conclusions is most appropriate based on this finding?

Accepted Answer

The memory region indicates that explorer.exe has been injected with malicious code, as it exhibits characteristics of process hollowing or reflective DLL injection.. A memory region with PAGE_EXECUTE_READWRITE protection, containing a PE header, and not backed by a file is a strong indicator of code injection. Legitimate processes rarely allocate such memory, and the presence of a PE header suggests a portable executable was loaded directly into memory. This is consistent with techniques like reflective DLL injection or process hollowing, where malicious code is executed within a trusted process to evade detection.

Answer

The memory region is likely a legitimate dynamically allocated buffer used by explorer.exe for temporary data storage.

Answer

The memory region is likely a memory-mapped file that was paged out and later paged back in without file backing due to a system error.

Answer

The memory region is a false positive because windows.malfind often flags legitimate JIT-compiled code from .NET applications.

Question 12

A first responder is collecting volatile and non-volatile data from a running Windows Server 2019 system. The investigator needs to determine which user or process most recently renamed a specific file on an NTFS volume, but the $STANDARD_INFORMATION timestamps show only a modification time. Which NTFS artifact should the investigator query to find rename events that record the previous filename?

Accepted Answer

The $UsnJrnl:$J alternate data stream, which logs USN_RECORD entries including RENAME_OLD_NAME and RENAME_NEW_NAME reasons.. The USN change journal, stored in the $UsnJrnl:$J alternate data stream, records file system events with reason codes. RENAME_OLD_NAME and RENAME_NEW_NAME entries capture both the prior and current filenames along with a timestamp and the file reference number. This makes the USN journal the primary artifact for reconstructing rename activity on NTFS.

Answer

The $MFT's $FILE_NAME attribute, which stores a history of all previous names assigned to the file.

Answer

The $Secure:$SDS stream, which records security descriptor changes that occur during rename operations.

Answer

The $LogFile, which contains redo and undo records for all metadata transactions including filename changes.

Question 13

During a live-response investigation of a Windows 10 workstation, you need to determine which user account was interactively logged on at the console at the exact moment of the incident. Which artifact provides the most direct evidence of the currently active interactive session?

Accepted Answer

The Security event log entry 4624 with Logon Type 2 recorded at the time of the incident. An interactive logon is recorded as Security event 4624 with Logon Type 2, which is generated when a user authenticates at the console. Because the question asks who was actively logged on at the moment of the incident, that specific logon type is the most direct and reliable evidence, whereas logoff entries and profile hives persist or indicate termination rather than active presence.

Answer

The NTUSER.DAT registry hive loaded in the user's profile folder

Answer

The Security event log entry 4634 recording a logoff event

Answer

The Security event log entry 4647 recording a user-initiated logoff

Question 14

When inspecting a memory dump, you notice a process has a 'ParentProcessID' that does not exist in the process list. What does this suggest?

Accepted Answer

The process was likely orphaned by its parent.. A process with a non-existent parent ID often points to a 'orphaned' process, which is common when the parent process has already exited or was hidden. This is a red flag for malicious activity, as rootkits or malware often spawn sub-processes and then terminate the parent to hide the chain of execution. Identifying this is key to reconstructing the infection vector and timeline during a forensic investigation.

Answer

The process is a system idle thread.

Answer

The memory dump is corrupted.

Answer

The process is a legitimate background service.

Question 15

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Accepted Answer

Mount options such as relatime or noatime suppress continuous updates to file access timestamps to improve performance.. The ext4 file system supports the noatime mount option, which disables the updating of access times whenever files are read. This optimization significantly reduces disk I/O overhead but blinds investigators to critical file access timelines, making it difficult to prove whether a specific binary was actually executed by a local user.

Answer

The ext4 journal aggressively overwrites inode metadata before user-space tools can parse the raw blocks.

Answer

The operating system automatically randomizes inode timestamps every 24 hours to prevent precise profiling.

Answer

The Sleuth Kit parser inherently misinterprets the 64-bit epoch time structures utilized by modern Linux kernels.

Question 16

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Accepted Answer

The process has been infected via code injection. The presence of the 'MZ' header (the magic bytes for a Windows PE executable) in a memory region that is not backed by a file on disk (VadS) and is marked as PAGE_EXECUTE_READWRITE is definitive proof of an injected executable. The malware has loaded a complete, valid PE file directly into memory to run its payload, which is a classic indicator of advanced fileless malware that bypasses file-system-based security controls.

Answer

The process is running a standard, signed driver

Answer

The process is using a standard heap allocation

Answer

The memory segment is a legitimate shared DLL

Question 17

An incident responder is analyzing a compromised Windows 10 workstation in an enterprise environment. The adversary used a known malware family that injects code into a legitimate process and then clears the associated event log entries to hinder detection. The responder has a memory image captured from the live system and a disk image acquired afterward. Which artifact in the memory image is most likely to reveal the injected code region and its originating module, even if the on-disk executable was deleted?

Accepted Answer

The process's virtual address descriptor (VAD) tree and associated memory sections. The VAD tree is the memory structure that tracks every mapped region in a process, including private executable pages typical of code injection. Because injected code is often not backed by a file on disk, the VAD metadata is the most direct way to identify the anomalous region. Other artifacts like MFT records, Prefetch, or event logs may provide context but do not contain the injected code or its originating module.

Answer

The Security event log records in the memory image

Answer

The Windows Prefetch file for the injected process

Answer

The MFT record for the deleted executable

Question 18

What is the primary advantage of the $UsnJrnl over the $LogFile for long-term forensic analysis?

Accepted Answer

It has a much longer retention period.. The $UsnJrnl (Update Sequence Number Journal) is designed to track changes to files and directories over a long period. Unlike the $LogFile, which is a circular, short-term buffer for atomicity and recovery, the $UsnJrnl maintains a more persistent record of file activity. This makes it an invaluable source of historical metadata for investigators tracking how files were modified, created, or deleted over weeks or months.

Answer

It stores full file content for every transaction.

Answer

It is not volatile and survives power loss.

Answer

It contains the actual NTFS security descriptors.

Question 19

Why does the use of 'DKOM' (Direct Kernel Object Manipulation) by rootkits pose a significant challenge for traditional forensic tools that rely on the Windows API?

Accepted Answer

It hides the process by unlinking it from the process list. Traditional tools rely on the Windows API to list processes and threads. These APIs query the kernel's process list (ActiveProcessLinks). DKOM allows a rootkit to unlink a process from this list while leaving the process structure intact so it can still be scheduled for execution. Because the API only reports what the kernel's linked list reveals, the hidden process effectively disappears from standard tools, requiring forensic analysts to use memory-parsing techniques.

Answer

It encrypts the entire memory dump

Answer

It prevents the acquisition of the memory dump

Answer

It modifies the CPU instructions directly

Question 20

A forensic analyst is using a tool to generate a file system timeline from an NTFS volume. The tool outputs timestamps with nanosecond precision, but the analyst knows that NTFS stores timestamps with 100-nanosecond resolution. What is the most likely reason for the discrepancy?

Accepted Answer

The tool is converting the 100-nanosecond intervals to nanoseconds and displaying additional precision that does not exist.. NTFS timestamps are stored as 64-bit values in 100-nanosecond intervals. When a forensic tool displays them, it often converts to nanoseconds for readability, which can introduce apparent nanosecond precision. The underlying resolution remains 100 nanoseconds, so the extra digits are not meaningful for timeline granularity.

Answer

The tool is incorrectly interpreting the timestamp format, treating them as nanoseconds instead of 100-nanosecond intervals.

Answer

The tool is reading timestamps from a different file system that stores nanosecond precision.

Answer

The NTFS file system on this volume has been upgraded to support nanosecond timestamps.