GCFA Practice Test 21 — 15 Questions

Question 1

An analyst is examining a Windows system and needs to determine when a USB mass storage device was last connected. Which registry artifact should be examined to find the device's first and last connection times?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SYSTEM hive under CurrentControlSet\Enum\USBSTOR. USB mass storage devices are enumerated under CurrentControlSet\Enum\USBSTOR in the SYSTEM hive, and each device instance includes a Properties subkey with timestamps for first and last connection. Examining that key therefore provides the device identity and the connection timing needed to establish when the device was last attached to the system.

Answer

The NTUSER.DAT hive under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

The SECURITY hive under Policy\Secrets

Answer

The SOFTWARE hive under Microsoft\Windows\CurrentVersion\Uninstall

Question 2

Which NTFS master file table (MFT) record contains metadata about the MFT itself?

Accepted Answer

MFT Record 0. In NTFS, the MFT is treated as a file, and its metadata is stored within its own entry. Record 0 is reserved specifically for the MFT. This recursive structure is fundamental to the NTFS architecture, allowing the system to locate the MFT at boot time and parse the rest of the file system efficiently during startup processes.

Answer

MFT Record 1

Answer

MFT Record 5

Answer

MFT Record 255

Question 3

When analyzing the 'TypedPaths' registry key, what type of user activity is being reviewed?

Accepted Answer

Windows Explorer navigation paths. The 'TypedPaths' key is a goldmine for investigators as it stores the absolute paths that a user has manually entered into the Windows Explorer address bar. This artifact is highly reliable for proving user intent to access specific directories, including hidden folders or external media paths. By documenting where the user navigated, an analyst can build a compelling case regarding unauthorized file exploration that occurred outside of normal GUI clicking behavior.

Answer

Run dialog commands

Answer

Recently opened documents

Answer

External device connection history

Question 4

An organization discovers that an attacker is using 'Living off the Land' (LotL) binaries to execute malicious code. Why are LotL attacks particularly difficult to detect in an enterprise environment?

Accepted Answer

They utilize trusted system processes that are frequently used by administrators.. LotL attacks utilize legitimate, pre-installed system tools like PowerShell, WMI, or Certutil to execute malicious payloads. Because these tools are trusted and frequently used for legitimate administrative tasks, they often bypass traditional signature-based antivirus or allowlisting solutions. Detecting these requires sophisticated behavioral analysis, such as looking for anomalous command-line flags, unusual process ancestry, or unexpected execution patterns, which are significantly harder to differentiate from routine administrative activity compared to detecting known malicious malware binaries.

Answer

The tools are specifically designed by attackers to bypass security.

Answer

They operate entirely in memory and leave no file system artifacts.

Answer

The attacker encrypts the binaries so antivirus cannot scan them.

Question 5

Why might an analyst prefer using 'Super-Timeline' creation tools, such as log2timeline, over manual collection of file system timestamps?

Accepted Answer

They provide a comprehensive view by integrating metadata from multiple sources.. Super-timelines aggregate data from diverse sources including file systems, event logs, registry hives, and application-specific artifacts into a single chronological view. Manual timestamp collection is limited to file system metadata, which often fails to capture the 'why' behind an event. By aggregating disparate data, analysts can correlate file changes with system events, providing a much richer, holistic context that is necessary to solve complex, multi-stage security incidents.

Answer

They automatically decrypt all files for easier analysis.

Answer

They eliminate the need to preserve original forensic images.

Answer

They ensure all files are permanently deleted from the disk.

Question 6

During a forensic investigation of a Windows 10 system, an analyst observes that a file's $STANDARD_INFORMATION creation timestamp is 2020-01-01 10:00:00, while its $FILE_NAME creation timestamp is 2020-01-01 10:00:05. The system time zone is UTC-5. The analyst also notes that the file's $STANDARD_INFORMATION modification timestamp is 2020-01-01 10:00:00. What is the most likely explanation for the 5-second difference between the creation timestamps?

Accepted Answer

The 5-second difference is normal because $STANDARD_INFORMATION and $FILE_NAME timestamps are updated at different times during file creation.. A small difference of a few seconds between $STANDARD_INFORMATION and $FILE_NAME creation timestamps is normal and occurs because the two sets of timestamps are written at slightly different times during file creation. It is not necessarily an indicator of timestomping or other manipulation.

Answer

The file was timestomped, and the attacker set the $STANDARD_INFORMATION creation time to match the modification time.

Answer

The 5-second difference indicates that the file was copied from another volume, and the $FILE_NAME creation time was updated to the copy time.

Answer

The 5-second difference is due to the file system tunneling feature, which preserves the original creation time from a deleted file with the same name.

Question 7

During an investigation of a compromised Windows Server 2019, an analyst extracts the ShimCache (AppCompatCache) from the SYSTEM registry hive. The analyst needs to determine which executable was present on the system but may have been deleted. Which artifact within the ShimCache entry provides the best indication of file existence and last modification time?

Accepted Answer

The file path and last modified timestamp. ShimCache entries include the file path and, on Windows 8+, a last modified timestamp from the file's $STANDARD_INFORMATION attribute. This timestamp helps determine when the file was last modified, and the presence of the path confirms the file existed. Execution flags and run counts are not part of ShimCache; those are in UserAssist or Prefetch. Process IDs and hashes are also not stored in ShimCache.

Answer

The SHA256 hash of the executable

Answer

The execution flag and run count

Answer

The process ID and parent process ID

Question 8

An examiner is analyzing an NTFS volume from a Windows Server 2016 system that was abruptly powered off during a security incident. The examiner wants to determine recent file system changes that may not have been flushed to the $MFT. Which two NTFS artifacts should the examiner prioritize to reconstruct recent metadata operations? (Choose two.)

Accepted Answer

$LogFile. $LogFile and $UsnJrnl both record metadata operations. $LogFile is a write-ahead log that captures transactions before they are committed to the $MFT, making it valuable after an unexpected shutdown. $UsnJrnl provides a persistent change journal that records file and directory modifications. Together they can reconstruct recent activity that may not be present in the $MFT.

Answer

$Secure

Answer

$Bitmap

Answer

$Boot

Question 9

Which artifact is the primary location for finding 'Shellbag' data, which tracks user folder access history?

Accepted Answer

NTUSER.DAT hive. Shellbags are stored in the NTUSER.DAT registry hive. They provide an invaluable record of which folders a user has opened and the specific view settings applied to those folders. This artifact is critical for forensic investigations because it proves user presence in specific directories, which can be used to link a user account to the staging of malicious files or the browsing of sensitive data during an incident.

Answer

SYSTEM hive

Answer

SOFTWARE hive

Answer

SAM hive

Question 10

A forensic analyst is building a file system timeline from an NTFS volume and wants to ensure it includes reliable evidence of file creation and deletion events. Which two artifacts should the analyst prioritize to capture these events? (Choose two.)

Accepted Answer

$MFT entries, including unallocated records. The $MFT, including unallocated entries, provides timestamps for files that existed or were deleted. The $UsnJrnl:$J logs file system changes with timestamps, capturing creation and deletion events. Together, they offer a robust foundation for a file system timeline, allowing analysts to correlate timestamps and change records.

Answer

Volume Shadow Copy snapshots

Answer

$LogFile transaction log

Answer

$Bitmap allocation file

Question 11

During a timeline review of an NTFS volume, an analyst observes that a file's $STANDARD_INFORMATION modification time is several days earlier than its $FILE_NAME modification time, and the $STANDARD_INFORMATION creation time is also earlier than the $FILE_NAME creation time. The file is a suspected malware dropper. Which conclusion is best supported by this pattern?

Accepted Answer

The file was likely moved or renamed after its last content modification, causing the $FILE_NAME timestamps to update while $STANDARD_INFORMATION times remained older.. When a file is moved or renamed within an NTFS volume, the $FILE_NAME attribute timestamps are updated to the time of the operation, while $STANDARD_INFORMATION timestamps may remain unchanged. This produces a pattern where $FILE_NAME times are newer than $STANDARD_INFORMATION times. While timestomping can also create discrepancies, it typically makes $STANDARD_INFORMATION appear older, and without additional indicators the move or rename explanation is better supported by the specific pattern observed.

Answer

The file's timestamps were definitely manipulated with a timestomping tool that altered $STANDARD_INFORMATION.

Answer

The file was accessed by an antivirus scanner, which updated the $FILE_NAME access time and left $STANDARD_INFORMATION modification time unchanged.

Answer

The file was created by the operating system during installation, and the newer $FILE_NAME times reflect the last time it was backed up.

Question 12

During a forensic examination of a Windows 10 workstation, an analyst needs to determine which user account was interactively logged on at a specific date and time. The system is powered off and only the disk image is available. Which artifact should the analyst examine to find the most reliable record of interactive logon sessions, including logon type and timestamp?

Accepted Answer

Security event log, filtering for Event ID 4624 with Logon Type 2 or 10. Security event log entries with Event ID 4624 and Logon Type 2 or 10 provide definitive records of interactive and RemoteInteractive logons, including the account name, timestamp, and logon type. Other artifacts like shell bags, SRUM, or Prefetch may show user activity but lack the direct logon session details required to answer who was logged on and when.

Answer

Prefetch files, checking the last execution time of explorer.exe

Answer

NTUSER.DAT registry hive, examining the LastWrite time of the user's shell bags

Answer

SRUM database, querying the Network Usage table for active connections

Question 13

An analyst is reviewing a Windows 10 memory image captured from a workstation suspected of malware infection. While examining a process, the analyst notices that the process's page directory base (DTB) points to a valid address, but the process's image path on disk cannot be found. Which Volatility 3 plugin should the analyst use to determine if the process memory contains injected code?

Accepted Answer

windows.malfind. The windows.malfind plugin is designed to detect injected code by scanning for memory regions that are executable but not backed by a file on disk. In this scenario, the process's image path is missing, which is a red flag for injection. Malfind would reveal such anomalies, helping the analyst confirm the presence of injected code. Other plugins like pslist, netscan, and cmdline do not perform this type of memory analysis.

Answer

windows.netscan

Answer

windows.pslist

Answer

windows.cmdline

Question 14

While triaging a Linux web server, you find that '/usr/bin/sshd' was executed but the running process's parent is 'bash' rather than the systemd service manager, and the process has no associated listening socket. Which conclusion is best supported?

Accepted Answer

An attacker renamed a malicious binary to 'sshd' to blend in with legitimate processes.. On Linux, parent process and socket state are strong discriminators of legitimacy. A real sshd is started by systemd, which makes PID 1 its parent, and it binds port 22. A process carrying the sshd name but parented by bash and holding no listening socket could not be performing the SSH service role, so the most supportable conclusion is that a binary was renamed to mimic sshd.

Answer

The sshd binary was updated by the package manager during an unattended upgrade.

Answer

The sshd process is a legitimate child spawned by a user's SSH session.

Answer

The system experienced a crash and systemd restarted sshd through a recovery shell.

Question 15

During an incident response engagement, you discover that an attacker has compromised a Windows server and established persistence by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which of the following registry locations would you examine to find the configuration of this service?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Windows services are configured in the registry under HKLM\SYSTEM\CurrentControlSet\Services. Each service has its own subkey containing values like ImagePath, which specifies the executable to run, and Start, which determines the start type. Investigating this key allows you to identify malicious services and their executables.

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run