GCFA Practice Test 3 — 30 Questions

Question 1

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

This is a network logon using NTLM that warrants correlation with source host and account baseline.. Logon Type 3 identifies a network logon, and the NTLM authentication package means the session did not use Kerberos. That alone is not proof of compromise, but it is a meaningful indicator that must be baselined against the account's normal source hosts, logon patterns, and downstream privilege events before any conclusion about credential theft or lateral movement is drawn.

Answer

This is normal service account behavior and no further review is needed.

Answer

This proves credential theft via Pass-the-Hash against the service account.

Answer

This indicates a successful interactive console logon by an attacker.

Question 2

When investigating a suspected fileless malware infection, you identify an anomaly in the 'PowerShell' Operational log. Which event ID indicates the execution of a base64 encoded command string often used to obfuscate malicious scripts?

Accepted Answer

Event ID 4104. Event ID 4104 records the execution of a script block. Attackers frequently use PowerShell's -EncodedCommand parameter to bypass simple string-based signature detection. By analyzing the content of these logs, specifically looking for long, base64-encoded strings, analysts can decode the hidden payloads and reconstruct the attacker's actions, which is vital for understanding the full scope of a fileless attack that avoids traditional disk-based indicators.

Answer

Event ID 4100

Answer

Event ID 4103

Answer

Event ID 400

Question 3

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Accepted Answer

Decode the base64 string and perform script analysis. The command line uses the '-enc' parameter, indicating a base64-encoded PowerShell script. Forensic analysts must decode this string to understand the attacker's intent. Once decoded, the analyst can identify the actual commands being run—such as downloading additional payloads or communicating with C2 servers. This is critical in modern incident response because obfuscation is a routine tactic to evade basic keyword-based monitoring and initial detection by security analysts.

Answer

Search for the process name in the Shimcache

Answer

Check the MFT for the parent process file

Answer

Run a system file integrity check

Question 4

An attacker is using a living-off-the-land (LotL) technique to execute commands on a Linux server. Which log source is most likely to reveal the command-line arguments used?

Accepted Answer

Linux Audit Framework (auditd).. Linux auditd is the most robust tool for capturing process execution details. By configuring auditd to watch the 'execve' system call, responders can log every command executed, including its arguments, by every user on the system. This is invaluable during an incident because LotL techniques often use standard, trusted binaries to perform malicious acts, and command-line arguments are the only evidence distinguishing legitimate administrative use from an attacker's malicious actions.

Answer

Syslog (/var/log/syslog).

Answer

Apache Access Logs.

Answer

X11 Display Logs.

Question 5

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Accepted Answer

Take snapshots of all attached volumes for forensic imaging.. Evidence preservation in cloud environments requires non-destructive methods that maintain chain of custody while ensuring data integrity. By creating snapshots, isolating the affected instance, and extracting memory, responders ensure that the state of the system is preserved for deep forensic analysis. These steps are crucial because cloud instances are ephemeral and can be easily deleted or modified, which would destroy the evidence necessary to build a complete incident timeline and identify the root cause.

Answer

Shut down the instance immediately to stop the attack.

Answer

Delete all ephemeral logs to save on cloud storage costs.

Question 6

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Accepted Answer

Event ID 4624 with Logon Type 10.. The Windows Security Event log captures specific Logon Types that categorize the nature of the authentication. Logon Type 2 denotes an interactive local login, while Type 10 identifies Remote Interactive (RDP) sessions. Scheduled tasks typically utilize Type 4 (Batch) or Type 5 (Service), allowing analysts to differentiate between user-driven activity and automated system processes through forensic inspection of the event data.

Answer

Event ID 4672 during the authentication process.

Answer

Event ID 4648 involving the use of explicit credentials.

Answer

Event ID 4720 occurring at the same time.

Question 7

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Accepted Answer

The usage of 'IEX' to execute code in memory.. The command performs an 'In-Process' download and execution of a remote PowerShell script. By using 'IEX' (Invoke-Expression) combined with a web client download, the attacker executes the script directly in memory, bypassing the need to write a file to disk. This is a highly effective evasion technique that leaves minimal forensic footprint and is a standard delivery method for sophisticated, memory-resident malware payloads.

Answer

The usage of the 'echo' command.

Answer

The creation of a text file in C:\Users\Public.

Answer

The command uses the 'hidden' window flag.

Question 8

When reviewing Windows Event Logs, which event ID indicates that a user has successfully performed an interactive login, and why is this critical for identifying unauthorized lateral movement?

Accepted Answer

Event ID 4624, because it captures the logon type and source workstation.. Event ID 4624 is the primary indicator of a successful logon. Analyzing Logon Type 2 (interactive) or Logon Type 10 (Remote Desktop) allows analysts to track user access patterns. Monitoring these events helps distinguish between routine administrative access and abnormal logins occurring at odd hours or from unusual source IPs, which are standard red flags for compromised credentials being used by threat actors to traverse the network.

Answer

Event ID 4688, because it tracks the exact time of user authentication.

Answer

Event ID 4720, because it logs user account creation activity.

Answer

Event ID 4625, because it confirms the user has successfully bypassed MFA.

Question 9

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Accepted Answer

It is unreliable due to frequent updates by system services. The 'Last Accessed' timestamp is notoriously unreliable in forensic analysis because it is frequently updated by non-human system activity, such as antivirus scans or indexing services. Furthermore, many systems have the 'noatime' option enabled, which stops the OS from updating this field entirely. Because of this noise and potential for total absence, relying on this value for evidence of user activity is inherently dangerous and prone to producing false positives.

Answer

It is only updated if the file is moved to a different folder

Answer

It is the most easily forged timestamp in the MFT

Answer

It only exists on FAT32 file systems

Question 10

Which THREE items are typically stored in a thread's TEB (Thread Environment Block)?

Accepted Answer

Thread Local Storage (TLS) pointers. The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

Answer

Active process list pointer

Answer

Kernel-mode privilege level

Question 11

Which memory artifact is most useful for identifying the specific user account associated with a suspicious process?

Accepted Answer

The process security token. In Windows, every process is associated with a security token object that defines the user's identity, privileges, and groups. By extracting the security token structure associated with an EPROCESS object in memory, an analyst can determine the exact user context under which the process is executing. This is vital for determining if a process was launched with system privileges or by a compromised local user account during an incident.

Answer

The thread environment block (TEB)

Answer

The process environment block (PEB)

Answer

The registry hive file for the user

Question 12

Which attribute is used to store the location and length of file data runs in an NTFS MFT record?

Accepted Answer

$DATA. The $DATA attribute is responsible for storing the file's content or references to the clusters where the data resides on the disk. When the file is too large to be resident, the $DATA attribute contains 'data runs'—compacted descriptions of the starting cluster and the number of consecutive clusters allocated to the file, which the driver uses to read the file data.

Answer

$FILE_NAME

Answer

$INDEX_ROOT

Answer

$ATTRIBUTE_LIST

Question 13

What is the primary function of the ShellBags artifact in a Windows forensic investigation?

Accepted Answer

To demonstrate that a user navigated to a specific folder.. ShellBags are registry entries that store folder view preferences, such as window size, icon position, and folder sorting. For forensics, they are incredibly useful for proving that a user navigated to a specific directory in Windows Explorer. This is critical for demonstrating user intent, as it shows which folders were browsed, even if those folders were later deleted or were located on removable media that is no longer connected.

Answer

To track the history of web browser searches.

Answer

To log file deletion events in the Recycle Bin.

Answer

To record the last time a system was rebooted.

Question 14

An incident responder is reviewing EDR alerts and discovers an 'Account Manipulation' event. What is the most common reason why an attacker would target the 'Domain Admins' group during the post-exploitation phase?

Accepted Answer

To gain unrestricted control over the entire domain and its resources.. Targeting the Domain Admins group is the 'holy grail' for an attacker because it provides full control over the entire Active Directory domain. With these privileges, an attacker can disable security controls, create new accounts, exfiltrate sensitive data, and install persistent backdoors across all systems joined to the domain. This level of access effectively grants the attacker the ability to operate undetected and exert complete influence over the organization's enterprise infrastructure.

Answer

To bypass the need for multi-factor authentication on local machines.

Answer

To encrypt the Active Directory database for ransomware demands.

Answer

To hide their tracks by clearing the Windows Event logs globally.

Question 15

Which of the following describes the 'Principle of Least Privilege' applied to incident response accounts?

Accepted Answer

Limiting IR account access to only the specific data and systems needed for the investigation.. Using dedicated, limited-scope accounts for incident response ensures that if the responder's account is compromised, the attacker does not gain enterprise-wide administrative access. By providing only the permissions necessary for the investigation—such as read-only access to logs or forensic imaging permissions—the risk of accidental or malicious damage to the production environment is minimized, ensuring that the integrity of the IR process remains intact even in a hostile or complex environment.

Answer

Using a Domain Admin account for all investigation tasks to avoid access issues.

Answer

Granting forensic responders full system access to all network segments.

Answer

Ensuring all IR accounts have a shared password for rapid response coordination.

Question 16

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Accepted Answer

The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.. An $MFT record reflecting a modified time earlier than the creation time frequently occurs when a file is copied rather than moved. The copy operation assigns a new creation timestamp to the destination file while preserving the original modified timestamp from the source file. Recognizing this artifact helps forensic analysts trace the origin of stolen payloads across network shares or external drives.

Answer

The file system metadata was actively corrupted by malware to hinder timeline analysis.

Answer

The operating system experienced a severe clock synchronization failure during the write operation.

Answer

An automated defragmentation utility reorganized the cluster chain and inadvertently swapped the metadata values.

Question 17

During a response to an incident involving a web shell, you find that the attacker is using custom encoding to bypass WAF signatures. What is the best forensic approach to identify all impacted web files?

Accepted Answer

Perform a file integrity check against the original source code base.. When attackers use custom encoding to hide web shells, signature-based WAF detections are ineffective. The most robust method is to perform a differential analysis of the web application's codebase against a known-good baseline, such as the original source control repository. By automatically highlighting differences, you can identify injected code blocks that don't match authorized files, regardless of how they are encoded or obfuscated by the attacker during the injection process.

Answer

Run a regex-based search for common web shell function names.

Answer

Analyze WAF logs to identify all requests that resulted in 200 OK codes.

Answer

Examine the access logs for all requests containing encoded characters.

Question 18

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Accepted Answer

Timestomping. Attackers utilize anti-forensic techniques to break the chain of evidence. Timestomping specifically invalidates the reliability of file metadata, while log clearing removes the context required for correlation. Both techniques force analysts to move deeper into secondary artifacts like the USN Journal or volume shadow copies, significantly increasing the time and complexity of an investigation while testing the analyst's ability to cross-reference multiple data sources for evidence.

Answer

Updating system drivers

Answer

Using a web browser

Answer

Renaming a file

Question 19

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Accepted Answer

Discrepancies often reveal timestomping attempts by attackers.. The MFT contains two primary timestamps for each file: Standard Information (SI) and File Name (FN). Attackers often use 'timestomping' tools to modify the SI attributes to match legitimate files and hide their tracks. However, they frequently forget or are unable to modify the FN attributes, which are less accessible. Discrepancies between these timestamps are a definitive indicator of anti-forensic activity that analysts use to uncover hidden malicious file creation times.

Answer

SI attributes are updated by the OS, while FN attributes are static.

Answer

FN attributes are the only way to recover deleted files.

Answer

SI attributes are required for NTFS file permissions.

Question 20

An analyst is preparing to acquire memory from a compromised server. Which TWO of the following factors are the most critical to consider regarding the integrity of the evidence and system stability?

Accepted Answer

The footprint of the acquisition tool in RAM. When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

Answer

The bit-depth of the monitor attached to the server

Answer

The total capacity of the hard drive

Answer

The current time zone of the server