GCFA Practice Test 4 — 10 Questions

Question 1

During a memory forensics investigation, an analyst uses Volatility 3 to examine a Windows 10 memory image. The analyst runs the windows.malfind plugin and observes a memory region with PAGE_EXECUTE_READWRITE protection that contains a PE header and is not backed by a file on disk. The region is associated with a process named explorer.exe. Which of the following conclusions is most appropriate based on this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The memory region indicates that explorer.exe has been injected with malicious code, as it exhibits characteristics of process hollowing or reflective DLL injection.. A memory region with PAGE_EXECUTE_READWRITE protection, containing a PE header, and not backed by a file is a strong indicator of code injection. Legitimate processes rarely allocate such memory, and the presence of a PE header suggests a portable executable was loaded directly into memory. This is consistent with techniques like reflective DLL injection or process hollowing, where malicious code is executed within a trusted process to evade detection.

Answer

The memory region is likely a legitimate dynamically allocated buffer used by explorer.exe for temporary data storage.

Answer

The memory region is likely a memory-mapped file that was paged out and later paged back in without file backing due to a system error.

Answer

The memory region is a false positive because windows.malfind often flags legitimate JIT-compiled code from .NET applications.

Question 2

A first responder is collecting volatile and non-volatile data from a running Windows Server 2019 system. The investigator needs to determine which user or process most recently renamed a specific file on an NTFS volume, but the $STANDARD_INFORMATION timestamps show only a modification time. Which NTFS artifact should the investigator query to find rename events that record the previous filename?

Accepted Answer

The $UsnJrnl:$J alternate data stream, which logs USN_RECORD entries including RENAME_OLD_NAME and RENAME_NEW_NAME reasons.. The USN change journal, stored in the $UsnJrnl:$J alternate data stream, records file system events with reason codes. RENAME_OLD_NAME and RENAME_NEW_NAME entries capture both the prior and current filenames along with a timestamp and the file reference number. This makes the USN journal the primary artifact for reconstructing rename activity on NTFS.

Answer

The $MFT's $FILE_NAME attribute, which stores a history of all previous names assigned to the file.

Answer

The $Secure:$SDS stream, which records security descriptor changes that occur during rename operations.

Answer

The $LogFile, which contains redo and undo records for all metadata transactions including filename changes.

Question 3

During a live-response investigation of a Windows 10 workstation, you need to determine which user account was interactively logged on at the console at the exact moment of the incident. Which artifact provides the most direct evidence of the currently active interactive session?

Accepted Answer

The Security event log entry 4624 with Logon Type 2 recorded at the time of the incident. An interactive logon is recorded as Security event 4624 with Logon Type 2, which is generated when a user authenticates at the console. Because the question asks who was actively logged on at the moment of the incident, that specific logon type is the most direct and reliable evidence, whereas logoff entries and profile hives persist or indicate termination rather than active presence.

Answer

The NTUSER.DAT registry hive loaded in the user's profile folder

Answer

The Security event log entry 4634 recording a logoff event

Answer

The Security event log entry 4647 recording a user-initiated logoff

Question 4

When inspecting a memory dump, you notice a process has a 'ParentProcessID' that does not exist in the process list. What does this suggest?

Accepted Answer

The process was likely orphaned by its parent.. A process with a non-existent parent ID often points to a 'orphaned' process, which is common when the parent process has already exited or was hidden. This is a red flag for malicious activity, as rootkits or malware often spawn sub-processes and then terminate the parent to hide the chain of execution. Identifying this is key to reconstructing the infection vector and timeline during a forensic investigation.

Answer

The process is a system idle thread.

Answer

The memory dump is corrupted.

Answer

The process is a legitimate background service.

Question 5

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Accepted Answer

Mount options such as relatime or noatime suppress continuous updates to file access timestamps to improve performance.. The ext4 file system supports the noatime mount option, which disables the updating of access times whenever files are read. This optimization significantly reduces disk I/O overhead but blinds investigators to critical file access timelines, making it difficult to prove whether a specific binary was actually executed by a local user.

Answer

The ext4 journal aggressively overwrites inode metadata before user-space tools can parse the raw blocks.

Answer

The operating system automatically randomizes inode timestamps every 24 hours to prevent precise profiling.

Answer

The Sleuth Kit parser inherently misinterprets the 64-bit epoch time structures utilized by modern Linux kernels.

Question 6

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Accepted Answer

The process has been infected via code injection. The presence of the 'MZ' header (the magic bytes for a Windows PE executable) in a memory region that is not backed by a file on disk (VadS) and is marked as PAGE_EXECUTE_READWRITE is definitive proof of an injected executable. The malware has loaded a complete, valid PE file directly into memory to run its payload, which is a classic indicator of advanced fileless malware that bypasses file-system-based security controls.

Answer

The process is running a standard, signed driver

Answer

The process is using a standard heap allocation

Answer

The memory segment is a legitimate shared DLL

Question 7

An incident responder is analyzing a compromised Windows 10 workstation in an enterprise environment. The adversary used a known malware family that injects code into a legitimate process and then clears the associated event log entries to hinder detection. The responder has a memory image captured from the live system and a disk image acquired afterward. Which artifact in the memory image is most likely to reveal the injected code region and its originating module, even if the on-disk executable was deleted?

Accepted Answer

The process's virtual address descriptor (VAD) tree and associated memory sections. The VAD tree is the memory structure that tracks every mapped region in a process, including private executable pages typical of code injection. Because injected code is often not backed by a file on disk, the VAD metadata is the most direct way to identify the anomalous region. Other artifacts like MFT records, Prefetch, or event logs may provide context but do not contain the injected code or its originating module.

Answer

The Security event log records in the memory image

Answer

The Windows Prefetch file for the injected process

Answer

The MFT record for the deleted executable

Question 8

What is the primary advantage of the $UsnJrnl over the $LogFile for long-term forensic analysis?

Accepted Answer

It has a much longer retention period.. The $UsnJrnl (Update Sequence Number Journal) is designed to track changes to files and directories over a long period. Unlike the $LogFile, which is a circular, short-term buffer for atomicity and recovery, the $UsnJrnl maintains a more persistent record of file activity. This makes it an invaluable source of historical metadata for investigators tracking how files were modified, created, or deleted over weeks or months.

Answer

It stores full file content for every transaction.

Answer

It is not volatile and survives power loss.

Answer

It contains the actual NTFS security descriptors.

Question 9

Why does the use of 'DKOM' (Direct Kernel Object Manipulation) by rootkits pose a significant challenge for traditional forensic tools that rely on the Windows API?

Accepted Answer

It hides the process by unlinking it from the process list. Traditional tools rely on the Windows API to list processes and threads. These APIs query the kernel's process list (ActiveProcessLinks). DKOM allows a rootkit to unlink a process from this list while leaving the process structure intact so it can still be scheduled for execution. Because the API only reports what the kernel's linked list reveals, the hidden process effectively disappears from standard tools, requiring forensic analysts to use memory-parsing techniques.

Answer

It encrypts the entire memory dump

Answer

It prevents the acquisition of the memory dump

Answer

It modifies the CPU instructions directly

Question 10

A forensic analyst is using a tool to generate a file system timeline from an NTFS volume. The tool outputs timestamps with nanosecond precision, but the analyst knows that NTFS stores timestamps with 100-nanosecond resolution. What is the most likely reason for the discrepancy?

Accepted Answer

The tool is converting the 100-nanosecond intervals to nanoseconds and displaying additional precision that does not exist.. NTFS timestamps are stored as 64-bit values in 100-nanosecond intervals. When a forensic tool displays them, it often converts to nanoseconds for readability, which can introduce apparent nanosecond precision. The underlying resolution remains 100 nanoseconds, so the extra digits are not meaningful for timeline granularity.

Answer

The tool is incorrectly interpreting the timestamp format, treating them as nanoseconds instead of 100-nanosecond intervals.

Answer

The tool is reading timestamps from a different file system that stores nanosecond precision.

Answer

The NTFS file system on this volume has been upgraded to support nanosecond timestamps.