GCFA Practice Test 1 — 25 Questions

Question 1

An enterprise incident response team is handling a breach where the adversary used valid credentials to access a cloud-hosted email service and created a mailbox forwarding rule to exfiltrate messages. The team has identified the compromised account and wants to determine the full scope of mailbox access and rule creation across the tenant. Which single action should the responder take to obtain the authoritative audit record of these activities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export the Unified Audit Log from the Microsoft 365 compliance center and filter for mailbox rule and access events. The Unified Audit Log is the authoritative tenant-wide record for mailbox access and rule creation in Microsoft 365. It captures events like New-InboxRule and MailItemsAccessed, allowing the responder to determine the full scope of adversary activity. Message trace, client logs, and Microsoft Entra ID sign-in logs provide complementary but incomplete views and do not record the mailbox-level actions needed.

Answer

Run a message trace in the Exchange admin center for the past 30 days

Answer

Inspect the Azure AD sign-in logs for the compromised account

Answer

Review the mailbox owner's Outlook client logs on their workstation

Question 2

An analyst is examining the USN Journal. What is the primary purpose of this file in the context of NTFS forensic analysis?

Accepted Answer

Providing a history of file system changes.. The USN Journal ($UsnJrnl) provides a chronological log of all changes made to files and directories on an NTFS volume. For forensics, it is invaluable because it captures activity that may no longer be reflected in the current MFT, such as the creation and subsequent deletion of files, or directory renames, providing a persistent history of disk modifications for timeline reconstruction.

Answer

Storing encrypted file passwords.

Answer

Maintaining the B-tree structure of directories.

Answer

Tracking user login and logout sessions.

Question 3

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Accepted Answer

Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.. Sysmon ProcessAccess events targeting lsass.exe with access masks like 0x1010 or 0x1410 directly show attempts to read LSASS memory, which is central to credential dumping. Similarly, an lsass.dmp file created in a user-writable directory with a corresponding file creation event provides concrete evidence of memory dumping. Both artifacts are high-fidelity indicators of credential theft.

Answer

Windows Security event ID 4672 indicating special privileges assigned to a new logon for a service account.

Answer

Windows Security event ID 4688 with process creation for a known credential dumping tool, including its command line.

Answer

Windows Security event ID 4624 logon type 3 (network) from a workstation to the domain controller.

Question 4

When creating a super-timeline using tools like log2timeline, why is it critical to filter the output data?

Accepted Answer

Filtering isolates relevant events from the massive volume of benign system activity. Super-timelines ingest massive amounts of data from diverse sources, including system logs, web history, and file system metadata. Without filtering, the volume of 'noise' from routine system activity makes it nearly impossible to isolate the specific events relevant to an incident. Filtering allows the investigator to focus on anomalous patterns and specific time windows, drastically increasing the efficiency and accuracy of the forensic reconstruction process during a high-pressure investigation.

Answer

Filtering increases the precision of the file system's internal clock

Answer

Filtering removes redundant entries to prevent system crashes during analysis

Answer

Filtering is required to encrypt the timeline output for secure storage

Question 5

An analyst reviewing Windows event logs on a compromised workstation discovers a sudden spike in Event ID 4624 with Logon Type 3, followed immediately by Event ID 4672. The source IP address belongs to a non-routable internal subnet. Which forensic interpretation best explains this activity?

Accepted Answer

An adversary performed lateral movement using stolen administrative credentials over the network to access administrative shares.. This specific sequence indicates a network logon successfully authenticating an administrative user, frequently observed during lateral movement via SMB or PsExec. Understanding this pattern allows analysts to differentiate authorized administrative maintenance from credential-based attacks, mapping directly to attacker tactics in enterprise environments.

Answer

An interactive user logged into the local console, triggering default privilege escalation assignments.

Answer

A scheduled batch job executed locally using stored credentials without generating network authentication traffic.

Answer

A service account automatically restarted following a system crash, initiating local service control manager requests.

Question 6

An investigator is analyzing ext4 file system timelines extracted via fls and mactime. They notice that an inode's ctime was updated recently, but the atime and mtime remained unchanged. What does this specific combination of inode timestamp changes typically indicate in a Linux environment?

Accepted Answer

The file permissions, ownership, or extended attributes were altered without modifying the underlying data blocks.. In ext4 file systems, the inode change time (ctime) updates whenever the inode metadata is modified, even if the file content (mtime) or access time (atime) remains untouched. Recognizing that metadata-only operations like permission changes or ownership transfers update ctime independently is critical for distinguishing between content tampering and permission hardening.

Answer

The file contents were modified via a redirected write operation from a standard unprivileged user shell script.

Answer

A background process read the file contents while the file system was mounted with strictatime options enabled.

Answer

The file was accessed and executed in memory using a shared library mapping that suppressed standard kernel logging.

Question 7

Based on the process metadata provided in the exhibit, what is the most significant indicator that requires further investigation?

Accepted Answer

The ParentPID value. The process name 'svchost.exe' is a common target for masquerading. While the path seems correct, the Parent Process ID (PPID) is the critical indicator. A legitimate svchost.exe should always be spawned by 'services.exe'. If the PPID 567 points to an unexpected process, such as an explorer.exe or a temporary file, it indicates a potential process masquerading or injection attempt, warranting immediate deep-dive analysis of that parent process.

Answer

The command line contains -k netsvcs

Answer

The process path is C:\Windows\System32\

Answer

The process name is svchost.exe

Question 8

An analyst discovers a file on a system that appears to be a 'hidden' executable. Which attribute of the NTFS file system, if modified, is a common indicator of a user attempting to conceal a file from standard Explorer views?

Accepted Answer

File Attribute Flags (MFT). NTFS file attributes allow users to hide files from the standard Windows Explorer interface. By checking the File Attributes field in the Master File Table (MFT), an analyst can identify files marked with the 'Hidden' or 'System' attribute. This is a common, albeit simple, anti-forensics technique used by adversaries to prevent casual discovery of malicious binaries or staged data, and it is the first step in identifying deliberate concealment attempts.

Answer

File Creation Timestamp

Answer

Extended Attributes (EA)

Answer

Access Control List (ACL)

Question 9

Which THREE items are critical to inspect when analyzing a memory dump for evidence of Process Hollowing or Injection?

Accepted Answer

Memory Page Permissions (RWX). Process injection techniques often modify memory protections or inject code into existing legitimate processes. By comparing the disk-based image of a process with its memory-based representation, analysts can identify discrepancies in executable sections. Checking memory protections (e.g., RWX permissions) and identifying unbacked executable code in private memory regions are the primary methods for uncovering sophisticated persistent threats that operate entirely within the volatile memory space.

Answer

The system's Event Log files

Answer

The MFT file records

Question 10

When analyzing a memory capture, you notice a process has a 'hidden' network connection. Which artifact provides the best view of active network connections linked to specific process IDs?

Accepted Answer

TCP Endpoint structures. The TCP Endpoint structures in kernel memory are essential for mapping network activity to process ownership. Attackers often attempt to hide connections using rootkit techniques, but these structures in memory usually remain accurate. Linking a specific PID to a remote IP address allows the analyst to identify Command and Control (C2) communication, which is the most reliable way to identify an active, compromised host during a live incident response.

Answer

DNS cache

Answer

Shimcache

Answer

Amcache.hve

Question 11

An analyst is building a file system timeline from an NTFS volume and is deciding which timestamps to extract from the $STANDARD_INFORMATION attribute. A colleague suggests that the four timestamps in $STANDARD_INFORMATION are the only relevant times. Which statement correctly describes the relationship between $STANDARD_INFORMATION and $FILE_NAME timestamps?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME each contain four timestamps, and comparing them can reveal timestamp manipulation or file moves.. NTFS stores timestamps in both the $STANDARD_INFORMATION and $FILE_NAME attributes of an MFT record. The two sets are maintained by different mechanisms and can disagree, which is itself valuable evidence. An analyst should extract both and compare them rather than relying on a single source, because the discrepancies often indicate moves, renames, or deliberate timestamp alteration.

Answer

$STANDARD_INFORMATION timestamps are always more reliable than $FILE_NAME timestamps and should be used exclusively.

Answer

$FILE_NAME timestamps are only populated when a file is created and never change afterward.

Answer

$FILE_NAME timestamps are duplicates of $STANDARD_INFORMATION and can be ignored.

Question 12

An analyst is investigating a Windows 10 system and wants to determine the last time a specific user logged on interactively. The analyst has access to the Security event log. Which event ID should the analyst examine to find this information?

Accepted Answer

4624. Event ID 4624 is the primary event for successful logons. It contains detailed information including the logon type, which distinguishes interactive (type 2 or 10) from network (type 3) or other logons. By filtering for the specific user account and logon types 2 and 10, the analyst can identify the most recent interactive logon. This is a standard technique in Windows forensic analysis.

Answer

4625

Answer

4647

Answer

4634

Question 13

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 14

An investigator analyzing an NTFS volume notices that a file's $STANDARD_INFORMATION MACB timestamps significantly differ from its $FILE_NAME timestamps. The $FILE_NAME modification time predates the $STANDARD_INFORMATION modification time. What is the most reliable forensic interpretation of this discrepancy?

Accepted Answer

The file was likely subjected to time-stomping where user-space tools altered the $STANDARD_INFORMATION attributes, leaving the original $FILE_NAME timestamps intact.. Timestamp discrepancies between the $STANDARD_INFORMATION and $FILE_NAME attributes often indicate file manipulation, copying, or time-stomping. Since the $STANDARD_INFORMATION attribute can be easily modified by user-space APIs while the $FILE_NAME attribute is managed directly by the NTFS driver, comparing both provides crucial insight into anti-forensic activities and accurate timeline reconstruction during incident response investigations.

Answer

The file was compressed using NTFS compression, which automatically updates the $STANDARD_INFORMATION modification timestamp while leaving $FILE_NAME untouched.

Answer

An automated defragmentation utility ran on the volume, updating the high-level metadata without altering the underlying filename structure.

Answer

The operating system experienced an unclean shutdown, causing the lazy writer thread to flush $STANDARD_INFORMATION changes out of synchronization with $FILE_NAME.

Question 15

An incident responder is preparing to acquire a forensic image of a running Windows server that is suspected of being compromised. The server hosts a critical database that cannot be taken offline. Which method is most appropriate for acquiring the disk image while minimizing disruption?

Accepted Answer

Use a live acquisition tool like FTK Imager or Magnet ACQUIRE to create a forensic image of the disk while the system is running.. For a running server that cannot be taken offline, live acquisition with a tool like FTK Imager or Magnet ACQUIRE is the best option. These tools create a forensic image of the disk while the system is operational, preserving the data with minimal disruption. However, they should be used in conjunction with volatile data collection to capture memory and network state.

Answer

Use a hardware write blocker and remove the disk to image it on a separate workstation.

Answer

Run the built-in Windows backup utility to create a system image to a network share.

Answer

Use diskpart to create a shadow copy and then copy the volume to an external drive.

Question 16

Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?

Accepted Answer

It holds the metadata for all files on the volume.. The MFT is the central database of an NTFS volume. It stores metadata for every file and directory on the disk, including file names, sizes, timestamps, and data runs. For forensic analysts, the MFT is the most important artifact, as it provides a comprehensive map of all files, including deleted ones, allowing for the reconstruction of the file system and identification of malicious files that were intentionally erased by an adversary.

Answer

It is an application log that tracks system crashes.

Answer

It stores user credentials for encrypted files.

Answer

It is only used to store files larger than 1GB.

Question 17

An incident responder is analyzing a memory image from a Windows 10 system that is suspected of being infected with a fileless malware. The responder runs the Volatility 3 windows.malfind plugin and observes several memory regions with PAGE_EXECUTE_READWRITE protection and a MZ header. However, the responder notices that some of these regions are backed by a file on disk, while others are not. Which of the following conclusions is most appropriate regarding the unbacked regions?

Accepted Answer

The unbacked regions are indicative of injected code or shellcode, as they do not correspond to any file on disk and have suspicious permissions.. In memory forensics, unbacked memory regions with PAGE_EXECUTE_READWRITE protection and executable content such as an MZ header strongly suggest injected code or shellcode. Legitimate code is typically backed by a file on disk via a mapped section. The lack of file backing means the code was likely written directly into the process's address space by an injection technique, a common characteristic of fileless malware. This finding should prompt further extraction and analysis of the injected payload.

Answer

The unbacked regions are likely legitimate DLLs loaded from disk but with modified permissions due to process hardening.

Answer

The unbacked regions are artifacts of the Volatility plugin itself, which may incorrectly report memory as unbacked due to parsing errors.

Answer

The unbacked regions are likely due to memory compression or paging, where the file backing was temporarily removed from the working set.

Question 18

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable. The analyst wants to determine whether the executable was actually executed on the system. Which additional artifact should the analyst examine to confirm execution?

Accepted Answer

Prefetch files. Prefetch files are created by the Windows Cache Manager when an executable is run, recording the execution time and run count. This directly confirms execution. ShimCache only shows that a file was present and may have been executed, so Prefetch is the best additional artifact to verify execution. Amcache, UserAssist, and SRUM may provide supporting evidence but are not as definitive or comprehensive for this purpose.

Answer

SRUM (System Resource Usage Monitor)

Answer

Amcache.hve

Answer

UserAssist

Question 19

A forensic analyst is examining a memory dump from a Windows 10 system that is suspected of being infected with a rootkit that hides its presence by unlinking its process from the active process list. The analyst runs Volatility 3 and compares the output of the windows.pslist and windows.psscan plugins. Which of the following best describes the expected discrepancy between these two plugins in the presence of such a rootkit?

Accepted Answer

windows.psscan will show more processes than windows.pslist because it can detect processes that have been unlinked from the active process list.. windows.pslist enumerates processes by following the active process list, which a rootkit can manipulate by unlinking its process. windows.psscan, however, scans memory for process objects using pool tags, which does not rely on the list. Therefore, in the presence of a process-unlinking rootkit, windows.psscan will detect the hidden process, resulting in a higher process count compared to windows.pslist. This discrepancy is a key indicator of hidden processes.

Answer

windows.pslist will show more processes than windows.psscan because it includes terminated processes that are still in memory.

Answer

Both plugins will show the same number of processes because they both use the same underlying data structure.

Answer

windows.psscan will show fewer processes than windows.pslist because it relies on a linked list that the rootkit modifies.

Question 20

An analyst is examining a memory image from a Windows 10 system that is suspected of being infected with malware that uses process hollowing. The analyst wants to identify processes that may have been hollowed. Which TWO of the following artifacts or techniques are most indicative of process hollowing? (Choose two.)

Accepted Answer

The process's image path in memory does not match the file path on disk.. Process hollowing involves creating a legitimate process in a suspended state, unmapping its memory, and injecting malicious code. This results in two key indicators: the in-memory image path may not match the disk file (or the memory content differs from disk), and threads execute from memory regions not backed by a file. These artifacts are directly tied to the hollowing technique and are detectable through memory analysis.

Answer

The process's token indicates it is running with elevated privileges.

Answer

The process's parent process ID (PPID) is a non-existent process.

Answer

The process has a large number of open handles to remote named pipes.