GCFA Practice Test 22 — 15 Questions

Question 1

Which THREE of the following are considered 'living-off-the-land' (LotL) techniques used by attackers to avoid detection?

Accepted Answer

Utilizing WMI (Windows Management Instrumentation) to execute remote commands.. LotL techniques leverage legitimate, pre-installed administrative tools to perform malicious actions. Because these binaries are signed and expected to be present in the environment, traditional endpoint protection often ignores them. Attackers use these tools for discovery, lateral movement, and execution, effectively hiding their activity in the noise of normal system administration tasks, which makes them highly effective for stealthy operations within a compromised network.

Answer

Installing a custom kernel-mode rootkit for persistence.

Answer

Running a custom C++ backdoor compiled on the target.

Question 2

A forensic analyst is examining a Windows 10 system and wants to determine which USB storage devices have been connected to the machine. The analyst has access to the registry. Which registry key should the analyst examine to find a list of USB devices that have been connected, including vendor and product IDs?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum is the authoritative location for USB mass storage device connection history. It records the vendor, product, and revision of each device, along with a serial number when available. Other USB-related keys either include non-storage devices or lack the detailed storage-specific information needed to identify connected USB drives.

Answer

HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Enum

Question 3

Which artifact is the most reliable for determining if an external USB mass storage device was mounted on a system, even if the device is no longer present?

Accepted Answer

USBSTOR Registry Key. The 'USBSTOR' registry key in the SYSTEM hive is the definitive artifact for tracking USB device history. It records the vendor, model, and unique serial number of every USB device ever connected. This is critical for forensic investigations involving data exfiltration, as it allows the investigator to prove that a specific physical device was present, regardless of whether the user deleted the device drivers or emptied the recycle bin.

Answer

Prefetch files

Answer

ShellBags

Answer

SRUM (System Resource Usage Monitor)

Question 4

A forensic analyst is investigating a Windows workstation that is suspected of being compromised by a fileless malware attack. The analyst has acquired a memory image and a disk image. Which TWO of the following artifacts, when analyzed together, would provide the strongest evidence that a fileless attack has occurred and is currently active? (Choose two.)

Accepted Answer

PowerShell operational log event ID 4104 containing an encoded script that decodes to a reflective loader. Fileless malware operates by injecting code into memory and often uses scripts like PowerShell to load payloads reflectively without writing executables to disk. Finding injected code in a legitimate process's memory via memory forensics, combined with a PowerShell script block log showing an encoded reflective loader, provides strong evidence of an active fileless attack. The other artifacts—prefetch, service creation with a binary, and ShimCache—all indicate disk-based execution, which is inconsistent with a fileless attack.

Answer

An entry in the ShimCache (AppCompatCache) for a malicious binary

Answer

A newly created service with a binary path pointing to a suspicious executable in C:\Windows\Temp

Answer

A prefetch file for a known malicious executable on disk

Question 5

A GCFA analyst is examining a Windows 10 memory image and wants to identify processes that were running when the image was captured, including those that may have terminated but left residual structures. The analyst uses Volatility 3. Which two plugins should the analyst use to enumerate processes from different sources? (Choose two.)

Accepted Answer

windows.pslist. windows.pslist enumerates processes from the active process list, while windows.psscan scans memory for process structures, which can uncover terminated or hidden processes. Using both provides a more comprehensive view of processes that were running or had recently terminated. The other plugins either rely on the same active list or serve different purposes.

Answer

windows.handles

Answer

windows.cmdline

Answer

windows.pstree

Question 6

What is the primary function of the $ATTRIBUTE_LIST attribute in an MFT entry?

Accepted Answer

To reference attributes stored in other MFT records.. The $ATTRIBUTE_LIST attribute is used when an MFT record is too small to hold all of a file's attributes. By storing a list of references to other MFT records, NTFS allows a single file to span multiple records. This is a crucial concept for analysts because it means that critical evidence, such as timestamps or data runs, might be hidden in secondary MFT records outside the primary entry.

Answer

To index directory contents.

Answer

To store extended file permissions.

Answer

To track file deletion history.

Question 7

A forensic analyst is examining a memory dump from a Windows Server 2016 system that is suspected of being compromised by a kernel-mode rootkit. The analyst wants to identify hidden processes that are not visible through standard process enumeration. Which two Volatility 3 plugins should the analyst use to detect hidden processes by comparing different process listing methods? (Choose two.)

Accepted Answer

windows.psscan. To detect hidden processes, analysts compare the output of windows.pslist, which walks the active process list, with windows.psscan, which scans physical memory for process objects using pool tag scanning. Discrepancies where psscan finds processes not in pslist indicate hidden processes, often due to rootkit activity. The other plugins do not provide this comparison and are used for different forensic purposes.

Answer

windows.handles

Answer

windows.netscan

Answer

windows.dlllist

Question 8

In memory forensics, what is the role of the 'VAD' (Virtual Address Descriptor) tree?

Accepted Answer

To map virtual memory ranges for a process.. The VAD tree is a kernel structure used by the memory manager to keep track of the virtual memory ranges allocated to a process. It is essential for forensic analysts because it defines the memory map of a process, including which areas are executable, read-only, or writable. This structure is critical for identifying memory-resident threats that attempt to hide their presence by manipulating memory permissions to execute malicious code.

Answer

To store the process execution priority.

Answer

To log all network connections made.

Answer

To secure the process against buffer overflows.

Question 9

An organization detects a sophisticated adversary attempting to move laterally using Pass-the-Hash (PtH) techniques. Which THREE of the following configurations or practices are most effective at mitigating this risk?

Accepted Answer

Enable Credential Guard on all workstations and servers.. Pass-the-Hash exploits the way NTLM stores password hashes in memory. By limiting the scope of where privileged accounts can authenticate and restricting the use of legacy protocols like NTLM in favor of Kerberos, organizations can significantly shrink the attack surface. Implementing Credential Guard provides an additional layer of hardware-based isolation that prevents the extraction of these hashes from memory, effectively neutralising the primary mechanism that attackers rely on for lateral movement within a domain.

Answer

Increase the minimum password length requirement to 20 characters.

Answer

Regularly scan for and remove all local user accounts.

Question 10

An organization is deploying an EDR solution to improve incident response capabilities. What is the most critical factor to consider when configuring EDR policies for a production environment?

Accepted Answer

Balancing security posture with the risk of operational impact.. EDR policies must be carefully tuned to prevent false positives that can lead to system instability, such as inadvertently blocking critical business processes or causing performance degradation. In production, an 'alert-only' mode is often implemented first to gather data and validate the impact. Without proper testing and tuning, a overly aggressive EDR configuration can disrupt legitimate operations, causing more damage to business productivity than the threats the EDR is intended to mitigate.

Answer

Ensuring the EDR agent is configured to delete all suspicious files automatically.

Answer

Forcing all EDR logs to be stored in the cloud for infinite retention.

Answer

Disabling all other security tools to prevent agent conflict.

Question 11

An analyst suspects that an attacker used WMI (Windows Management Instrumentation) to execute code remotely. Which log file should be examined to confirm WMI-based process creation?

Accepted Answer

WMI-Activity/Operational.evtx. The 'Microsoft-Windows-WMI-Activity/Operational' log is the primary source for tracking WMI interactions. WMI is frequently abused for lateral movement because it allows for stealthy, authenticated command execution. By reviewing these specific operational logs, analysts can correlate WMI provider activity with process creation events, confirming whether a remote actor utilized WMI to launch malicious processes on the target system without needing an interactive shell session.

Answer

Security.evtx

Answer

System.evtx

Answer

Application.evtx

Question 12

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to remotely execute commands on the system. Which TWO artifacts should the analyst examine to corroborate this activity? (Choose two.)

Accepted Answer

System event log for Event ID 7045 (service installation). PsExec usage on a target system leaves two key artifacts: the installation of the PSEXESVC service, recorded in the System event log as Event ID 7045, and the execution of PSEXESVC.exe, which generates a Prefetch file. These directly indicate PsExec activity. Other artifacts like network logons or Amcache entries are less specific and may be caused by other activities.

Answer

Amcache.hve for entries related to PsExec.exe

Answer

SRUM database for network connections by PsExec.exe

Answer

Security event log for Event ID 4624 with Logon Type 3

Question 13

A forensic analyst is examining a Windows 10 system and finds a prefetch file named `CMD.EXE-1234ABCD.pf`. The analyst wants to determine the last time the program was executed. Which timestamp in the prefetch file should the analyst use?

Accepted Answer

The last run time stored internally in the prefetch file's header.. Prefetch files store an internal last run timestamp in their header, which is updated each time the program executes. Forensic tools like PECmd extract this timestamp, making it the most direct evidence of last execution. File system timestamps such as $STANDARD_INFORMATION Modified can correlate but are not as precise for execution time.

Answer

The file's $STANDARD_INFORMATION Modified timestamp in the MFT.

Answer

The file's $FILE_NAME Created timestamp in the MFT.

Answer

The volume's $LogFile entry for the prefetch file.

Question 14

Which registry hive contains the 'UserAssist' key, and what is its primary forensic value?

Accepted Answer

NTUSER.DAT hive; tracking user-initiated program execution. UserAssist is stored within the NTUSER.DAT hive of the specific user account. Its value lies in the rotational cipher (ROT13) used for the data, which, once decrypted, reveals a list of GUI-based programs executed by the user. This artifact is invaluable for linking specific user activity to the execution of malicious tools, providing proof that the user was behind the keyboard during the incident, as opposed to an automated system service.

Answer

SYSTEM hive; tracking system services

Answer

SOFTWARE hive; tracking installed application paths

Answer

SECURITY hive; tracking authentication logs

Question 15

You have acquired a memory image from a Windows Server 2019 system using WinPmem. You need to determine the operating system version and service pack level to ensure you use the correct Volatility profile or symbol table. Which Volatility 3 plugin provides this information directly from the memory image?

Accepted Answer

windows.info. To identify the operating system version and service pack from a memory image, you need a plugin that reads kernel version data. windows.info extracts this directly from the kernel structures in memory, providing the build number and service pack level. The other plugins focus on registry hives, process listing, and command lines, none of which directly report the OS version in a concise manner.

Answer

windows.cmdline

Answer

windows.registry.hivelist

Answer

windows.pslist