GCFA Practice Test 3 — 10 Questions

Question 1

During memory analysis of a Windows host, an examiner runs windows.netscan and observes several established TCP connections originating from a process that no longer appears in the process list. Which conclusion is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The connections are likely residual artifacts from a terminated process, and the examiner should correlate timestamps and process IDs to confirm.. windows.netscan can surface network structures that outlive their owning process, so missing process entries alongside established connections often reflect terminated processes rather than hidden malware. Correlating process IDs, timestamps, and other artifacts is the proper next step. Claiming rootkit activity, image corruption, or a confirmed attack from this observation alone is premature and unsupported.

Answer

The connections are proof of a network-based attack and should be reported as a confirmed incident.

Answer

The connections indicate that the memory image is corrupted and should be reacquired.

Answer

The connections prove that a rootkit is hiding a running process from the process list.

Question 2

When reviewing Jump Lists on a Windows system, which file extension is commonly associated with the 'AutomaticDestinations' folder?

Accepted Answer

.automaticDestinations-ms. Jump Lists, located in the AutomaticDestinations and CustomDestinations folders, track recently accessed files and applications. The files are identified by an AppID, which is a hash of the application's path. These files often end with the .automaticDestinations-ms extension. They are vital for identifying files opened by users, providing insight into document access, media playback, and tool usage that may relate to intellectual property theft or evidence of work.

Answer

.pf

Answer

.log

Answer

.lnk

Question 3

An analyst is triaging a Windows 10 workstation suspected of a fileless malware infection. The analyst needs to quickly identify whether a specific process has an injected thread by examining volatile memory. Which Volatility 3 plugin should be used to list threads and their associated start addresses for a given process?

Accepted Answer

windows.threads. The windows.threads plugin enumerates threads within a process, showing start addresses that can be compared against known module ranges. Injected threads often have start addresses in unbacked memory, making this plugin ideal for detecting code injection. The other plugins focus on memory regions, handles, or loaded modules, none of which provide thread-level detail needed to identify an injected thread.

Answer

windows.dlllist

Answer

windows.handles

Answer

windows.malfind

Question 4

During a live response on a Windows 10 workstation suspected of malware infection, an examiner captures a full physical memory image using WinPmem. The examiner later wants to determine whether the captured image contains enough context to reconstruct which user account was interactively logged on at the time of acquisition. Which memory structure would the examiner primarily parse to identify the active interactive session and its associated user?

Accepted Answer

The token object referenced by explorer.exe, because its user SID identifies the interactively logged-on account.. The interactive user's identity is tied to the token of a process running in that user's session, such as explorer.exe. Extracting the token SID from explorer.exe's EPROCESS in the memory image confirms which account was interactively logged on. Other structures like KDBG or winlogon's EPROCESS do not directly hold the interactive user SID, making them unsuitable for this specific attribution.

Answer

The KDBG structure, because it stores the list of logged-on user sessions and their SIDs.

Answer

The EPROCESS block for winlogon.exe, because it stores the Security Identifier (SID) of the interactive user.

Answer

The PEB of lsass.exe, because it caches the credentials of the interactive user in plaintext.

Question 5

When identifying a hidden process via a cross-view analysis, which memory structure is most reliable to compare against the EPROCESS list?

Accepted Answer

The thread list in the scheduler. Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Answer

The Master File Table (MFT)

Answer

The user-mode Process Environment Block (PEB)

Answer

The System Service Descriptor Table (SSDT)

Question 6

Which TWO of the following are considered reliable methods for detecting hidden processes in memory forensics?

Accepted Answer

psscan pool tag analysis. Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

Answer

pslist enumeration

Answer

Task Manager API polling

Answer

Registry hive parsing

Question 7

An enterprise incident response team is preparing to contain a confirmed ransomware outbreak that has already encrypted several file servers. The team must preserve forensic evidence while stopping further spread. Which two actions best balance evidence preservation with containment in this scenario? (Choose two.)

Accepted Answer

Isolate affected servers from the network at the switch or EDR level while keeping them powered on. Isolating affected servers at the network layer stops the spread without destroying volatile evidence, and capturing memory before containment preserves fragile artifacts such as encryption keys and active processes. Together they satisfy containment and preservation. Powering off, reimaging, or deleting files would destroy evidence or recovery options and do not represent a balanced response.

Answer

Reimage all affected servers immediately to restore business operations

Answer

Immediately power off all affected servers to halt encryption activity

Answer

Delete all encrypted files to prevent the ransomware from spreading further

Question 8

An incident responder is reviewing logs from a compromised Linux server and notices a large number of failed SSH login attempts from a single external IP address, followed by a successful login. Which of the following best describes this activity?

Accepted Answer

A brute-force attack that resulted in unauthorized access.. The sequence of numerous failed SSH logins from a single external IP followed by a successful login is a classic indicator of a brute-force attack that succeeded. This constitutes unauthorized access and requires immediate incident response actions, including isolating the server, investigating the attacker's activities, and resetting compromised credentials.

Answer

A misconfigured SSH client repeatedly attempting to authenticate with an expired key.

Answer

A denial-of-service attack that overwhelmed the SSH service.

Answer

A legitimate user who forgot their password and eventually guessed it correctly.

Question 9

A GCFA analyst is investigating a Windows Server 2019 system that was compromised via a PowerShell-based attack. The analyst has a memory image and the Windows event logs. The analyst wants to determine the exact PowerShell script block that was executed by a suspicious process. Which artifact or log source would provide the most direct evidence of the script block content?

Accepted Answer

Windows PowerShell event log, event ID 4104 (Script Block Logging).. Script Block Logging (event ID 4104) captures the actual PowerShell code that runs, including obfuscated or dynamically constructed script blocks, and writes it to the Windows PowerShell operational log. This is the most direct artifact for determining what a malicious PowerShell script did. Command-line auditing and memory plugins can show how PowerShell was launched but not the full script content. Therefore, the PowerShell event log with 4104 is the best source.

Answer

The windows.cmdline plugin output from the memory image showing the PowerShell process command line.

Answer

Windows Security event log, event ID 4688 (Process Creation) with command-line auditing enabled.

Answer

The windows.pslist plugin output showing the PowerShell process and its parent process.

Question 10

In the context of forensic timeline analysis, what does the term 'Time Skew' refer to?

Accepted Answer

The discrepancy between the system clock and the actual time. Time skew is the difference between the actual wall-clock time and the time reported by the system under investigation. Identifying and correcting for this skew is a fundamental prerequisite for timeline analysis. If the investigator ignores the skew, all events will be chronologically misaligned, making it impossible to correlate evidence across different machines or correlate logs with file system activity during the incident reconstruction phase.

Answer

The difference between local time and UTC

Answer

The intentional modification of a file's timestamp

Answer

The process of normalizing timestamps to a common format