GCFA Practice Test 4 — 25 Questions

Question 1

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.. An $MFT record reflecting a modified time earlier than the creation time frequently occurs when a file is copied rather than moved. The copy operation assigns a new creation timestamp to the destination file while preserving the original modified timestamp from the source file. Recognizing this artifact helps forensic analysts trace the origin of stolen payloads across network shares or external drives.

Answer

The file system metadata was actively corrupted by malware to hinder timeline analysis.

Answer

The operating system experienced a severe clock synchronization failure during the write operation.

Answer

An automated defragmentation utility reorganized the cluster chain and inadvertently swapped the metadata values.

Question 2

During a response to an incident involving a web shell, you find that the attacker is using custom encoding to bypass WAF signatures. What is the best forensic approach to identify all impacted web files?

Accepted Answer

Perform a file integrity check against the original source code base.. When attackers use custom encoding to hide web shells, signature-based WAF detections are ineffective. The most robust method is to perform a differential analysis of the web application's codebase against a known-good baseline, such as the original source control repository. By automatically highlighting differences, you can identify injected code blocks that don't match authorized files, regardless of how they are encoded or obfuscated by the attacker during the injection process.

Answer

Run a regex-based search for common web shell function names.

Answer

Analyze WAF logs to identify all requests that resulted in 200 OK codes.

Answer

Examine the access logs for all requests containing encoded characters.

Question 3

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Accepted Answer

Timestomping. Attackers utilize anti-forensic techniques to break the chain of evidence. Timestomping specifically invalidates the reliability of file metadata, while log clearing removes the context required for correlation. Both techniques force analysts to move deeper into secondary artifacts like the USN Journal or volume shadow copies, significantly increasing the time and complexity of an investigation while testing the analyst's ability to cross-reference multiple data sources for evidence.

Answer

Updating system drivers

Answer

Using a web browser

Answer

Renaming a file

Question 4

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Accepted Answer

Discrepancies often reveal timestomping attempts by attackers.. The MFT contains two primary timestamps for each file: Standard Information (SI) and File Name (FN). Attackers often use 'timestomping' tools to modify the SI attributes to match legitimate files and hide their tracks. However, they frequently forget or are unable to modify the FN attributes, which are less accessible. Discrepancies between these timestamps are a definitive indicator of anti-forensic activity that analysts use to uncover hidden malicious file creation times.

Answer

SI attributes are updated by the OS, while FN attributes are static.

Answer

FN attributes are the only way to recover deleted files.

Answer

SI attributes are required for NTFS file permissions.

Question 5

An analyst is preparing to acquire memory from a compromised server. Which TWO of the following factors are the most critical to consider regarding the integrity of the evidence and system stability?

Accepted Answer

The footprint of the acquisition tool in RAM. When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

Answer

The bit-depth of the monitor attached to the server

Answer

The total capacity of the hard drive

Answer

The current time zone of the server

Question 6

Refer to the exhibit. An examiner observes the process tree provided. Given standard Windows operating system architecture, which specific observation indicates a high probability of malicious activity?

Accepted Answer

The parent-child relationship of svchost.exe and explorer.exe. The exhibit shows explorer.exe being spawned by svchost.exe. In a standard Windows environment, explorer.exe is spawned by userinit.exe, which in turn is spawned by winlogon.exe. A service host process (svchost.exe) spawning the Windows shell is highly anomalous behavior. This pattern suggests an injection or a process replacement attack where a malicious service has hijacked the shell or launched a secondary GUI interface for persistent command and control.

Answer

The PID 1240 is assigned to svchost.exe

Answer

The existence of two svchost.exe processes

Answer

The PID of explorer.exe is higher than svchost.exe

Question 7

What does a non-resident $DATA attribute indicate in an NTFS MFT record?

Accepted Answer

The file data is stored in separate clusters.. A non-resident $DATA attribute indicates that the actual file content is stored in external data clusters on the disk, rather than inside the MFT record. This is the standard behavior for most files. Analysts must understand this to correctly use data runs, which are pointers found within the $DATA attribute that tell the OS exactly where to find the file's fragmented pieces on the physical media.

Answer

The file is too small to be resident.

Answer

The file is corrupted.

Answer

The file is permanently deleted.

Question 8

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Accepted Answer

The memory segment is a malicious injection. The combination of PAGE_EXECUTE_READWRITE protection and the absence of an associated file (File: None) is a classic indicator of malicious code injection. Normal applications rarely allocate memory that is simultaneously writable and executable, as this violates standard security practices like Data Execution Prevention (DEP). The lack of a file-backing suggests the code resides entirely in memory, a common technique for fileless malware to avoid detection by traditional on-disk antivirus scanners.

Answer

The memory segment is a standard heap allocation

Answer

The memory segment is a legitimate shared library

Answer

The memory segment is part of the system kernel

Question 9

An examiner suspects that a system has been compromised with a rootkit that hooks kernel functions. Which memory forensics technique is most appropriate to detect this?

Accepted Answer

Verifying the SSDT function pointers. Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

Answer

Analyzing the process environment block (PEB)

Answer

Enumerating all running threads

Answer

Scanning for file system changes in the MFT

Question 10

What is the primary role of the $MFTMirr file in NTFS?

Accepted Answer

To provide a backup of the first MFT records.. The $MFTMirr file contains a backup of the first few records of the Master File Table. This is vital for filesystem recovery if the primary MFT record gets corrupted. For forensic analysts, the $MFTMirr provides a fail-safe that confirms the structure of the MFT and can sometimes contain remnants of file metadata that are useful when the primary MFT record has been damaged or maliciously altered.

Answer

To mirror all file contents.

Answer

To index all files in the system.

Answer

To store encrypted file keys.

Question 11

An analyst discovers a suspicious executable in the C:\Users\Public folder. To determine if the file was executed, the analyst examines the Shimcache. Which behavior is characteristic of the Shimcache artifact?

Accepted Answer

It tracks file path and last modification time for potential application compatibility.. The Shimcache, or AppCompatCache, tracks file metadata to ensure application compatibility. Crucially, it tracks file paths and last modified times but does not natively record the exact execution timestamp of an application. It is primarily used to identify files that were present on the system and potentially executed, serving as a critical indicator of software presence during an investigation into lateral movement or malware persistence on a Windows endpoint.

Answer

It records the exact UTC execution time for all files in the SYSTEM hive.

Answer

Entries are only populated when the UserAssist key is enabled in the registry.

Answer

It is stored within the NTUSER.DAT hive for each individual user profile.

Question 12

An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?

Accepted Answer

$I file. In Windows 10, each deleted file in the Recycle Bin has a corresponding $I file that stores the original path, deletion time, and file size. The $R file contains the actual data. The $Recycle.Bin folder is the container, and INFO2 is obsolete. Therefore, the $I file is the correct artifact to examine.

Answer

INFO2 file

Answer

$Recycle.Bin folder

Answer

$R file

Question 13

An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?

Accepted Answer

The file was moved from another volume or manipulated using timestomping techniques.. This anomaly is frequently caused by the 'timestomping' technique or a file move operation where the original metadata is preserved. By understanding file system internals, an analyst recognizes that MFT entry times are susceptible to manipulation via user-mode tools or low-level API calls. Detecting these inconsistencies is critical for identifying anti-forensics activity or specific file system behaviors that could lead to misinterpretation of the true timeline of events.

Answer

The file system is corrupted and requires an immediate CHKDSK operation.

Answer

The operating system experienced a clock drift during the file write process.

Answer

The master file table is using short filename (8.3) format which ignores creation time.

Question 14

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Accepted Answer

The process with PID 4820.. The exhibit shows two active connections. The first is a standard SMB connection, but the second, PID 4820, connects to an external IP on port 443. This is highly suspicious for a server that should not have direct outbound HTTPS communication to an unknown external host. Identifying the process associated with PID 4820 allows the analyst to trace the activity back to the binary responsible for the unauthorized external communication, which is a key indicator of C2 traffic.

Answer

The process with PID 4.

Answer

The connection to 10.10.1.5.

Answer

The SMB connection on port 445.

Question 15

An analyst is reviewing a Windows 10 workstation that is suspected of being compromised by a fileless malware. The analyst has a memory image and wants to identify processes that have a thread start address pointing outside of any legitimate module. Which Volatility 3 plugin is most appropriate for this task?

Accepted Answer

windows.malfind. The malfind plugin is designed to detect hidden or injected code in memory by identifying memory regions that are both writable and executable and that lack a corresponding file on disk. It also reports the start address of threads within those regions. This makes it the correct choice for finding threads that start outside of legitimate modules, which is a common indicator of process injection or fileless malware.

Answer

windows.pslist

Answer

windows.cmdline

Answer

windows.netscan

Question 16

A workstation shows signs of an attacker establishing persistence. You want to identify a scheduled task that runs a suspicious binary at user logon. Which Windows artifact should you examine to find the task's action and trigger configuration?

Accepted Answer

The file C:\Windows\System32\Tasks\<TaskName> in the Task Scheduler store. Scheduled tasks are defined as XML files in the Task Scheduler store under C:\Windows\System32\Tasks, and each file includes the task's Triggers and Actions. A logon trigger with an action launching a suspicious binary is exactly the persistence configuration described, so inspecting that XML file directly reveals both the executable and the trigger that causes it to run at logon.

Answer

The Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders key in the SOFTWARE hive

Answer

The Microsoft\Windows NT\CurrentVersion\Winlogon key's Shell value in the SOFTWARE hive

Answer

The Software\Microsoft\Windows\CurrentVersion\Run key in the NTUSER.DAT hive

Question 17

An organization is responding to a ransomware incident. The attackers encrypted files on several servers and left a ransom note. Which immediate action should the incident response team take to preserve the most volatile evidence before shutting down the affected systems?

Accepted Answer

Collect volatile data such as memory and network connections.. The order of volatility dictates that the most volatile evidence, such as memory and network connections, should be collected first. In a ransomware incident, memory can contain encryption keys and indicators of compromise that are crucial for response and recovery. Disk imaging and containment actions can be performed afterward without losing this critical data. Interviews are non-technical and can be done at any time.

Answer

Interview system administrators about the ransomware note.

Answer

Disconnect the servers from the network to prevent further spread.

Answer

Capture a forensic image of the disk drives.

Question 18

An analyst is examining a Windows 10 system and wants to determine the last time a specific user logged on interactively. Which Windows Event Log should be examined to find the most recent interactive logon event?

Accepted Answer

Security Event Log, Event ID 4624 with Logon Type 2. Security Event ID 4624 with Logon Type 2 records interactive logons at the console. By examining the most recent such event, an analyst can determine when a user last logged on interactively. System Event ID 6005 relates to service startup, Application Event ID 1000 to application crashes, and Security Event ID 4634 to logoffs, none of which answer the question.

Answer

Application Event Log, Event ID 1000

Answer

Security Event Log, Event ID 4634

Answer

System Event Log, Event ID 6005

Question 19

During an enterprise-wide incident response, a Windows workstation is suspected of being compromised by a threat actor who used a spear-phishing document. The machine is still powered on and the user is logged in. You need to capture volatile evidence in a forensically sound manner. Which of the following is the correct order of volatility for collecting evidence, from most volatile to least volatile?

Accepted Answer

CPU registers and cache, routing table, RAM, temporary file systems, disk. The order of volatility dictates that the most perishable evidence be collected first. CPU registers and cache change with every instruction, routing tables and ARP caches expire quickly, and RAM loses its contents on power-off. Temporary file systems and disk are comparatively persistent. Following this sequence preserves the most fragile evidence before it is altered or destroyed by normal system activity or shutdown.

Answer

Temporary file systems, disk, RAM, routing table, CPU registers and cache

Answer

Disk, RAM, temporary file systems, routing table, CPU registers and cache

Answer

RAM, CPU registers and cache, disk, temporary file systems, routing table

Question 20

A forensic analyst is reviewing a Windows 10 workstation suspected of unauthorized data staging. While parsing the Master File Table with a commercial forensic suite, the analyst observes that a suspicious .zip file's $STANDARD_INFORMATION timestamps differ from its $FILE_NAME timestamps by more than six months, and the $FILE_NAME timestamps are older. Which conclusion is most consistent with this artifact pattern?

Accepted Answer

The $STANDARD_INFORMATION timestamps were likely altered by a timestomping utility, while the $FILE_NAME timestamps retained the original values.. NTFS stores two independent timestamp sets per file: $STANDARD_INFORMATION, writable through normal APIs, and $FILE_NAME, set at creation and rename. Anti-forensic tools commonly change only the former, producing a divergence where $FILE_NAME timestamps are older. This pattern is a reliable indicator of timestomping and should prompt deeper timeline analysis.

Answer

The file was created on a different NTFS volume and later copied onto this workstation using a tool that preserves $FILE_NAME timestamps.

Answer

The file was accessed by a backup application that updates only $STANDARD_INFORMATION timestamps during incremental backups.

Answer

The file system is corrupt and the $FILE_NAME attribute should be treated as unreliable, so only the $STANDARD_INFORMATION timestamps should be used for the timeline.