GCFA Practice Test 5 — 10 Questions

Question 1

An analyst is examining a Windows 10 host and finds that a suspicious process was launched shortly after a user logged on. To determine the exact time the process was created and capture its parent-child relationship, which artifact should the analyst prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sysmon Event ID 1 (Process Creation) in the Windows Event Log. Sysmon Event ID 1 provides the most granular and reliable data for process creation, including exact timestamps and parent-child relationships. Other artifacts like Prefetch, Amcache, and UserAssist offer execution evidence but lack the precision and relationship details needed to reconstruct the sequence of events accurately.

Answer

Prefetch files in C:\Windows\Prefetch

Answer

UserAssist registry keys

Answer

Amcache.hve registry hive

Question 2

A forensic analyst is reviewing Windows Security event logs to identify potential malicious activity. The analyst notices a series of Event ID 4625 (An account failed to log on) followed by Event ID 4624 (An account was successfully logged on) for the same user account within a short period. What is the most likely explanation for this pattern?

Accepted Answer

The user mistyped their password several times before successfully logging in.. The correct answer identifies that a few failed logons followed by a success are commonly caused by a user mistyping their password. This pattern is benign in isolation. Analysts should consider context, such as the number of attempts and source of logons, to differentiate from brute-force attacks.

Answer

The account is locked out and requires administrative intervention to unlock.

Answer

The system is experiencing a denial-of-service attack due to excessive failed logons.

Answer

An attacker has successfully brute-forced the user's password after multiple attempts.

Question 3

An incident responder is analyzing a Linux server that was compromised. The attacker gained initial access via SSH and then created a new user account named 'support' with UID 0. Which command should the responder use to quickly identify all accounts with UID 0 on the system?

Accepted Answer

cat /etc/passwd | grep ':0:'. The /etc/passwd file stores user account details, including the UID in the third field. Searching for ':0:' isolates accounts with UID 0, which have root privileges. This quickly uncovers any unauthorized root-equivalent accounts created by an attacker. Other commands like ls, ps, or netstat do not provide UID information and would not detect the malicious account.

Answer

netstat -tulpn

Answer

ps aux | grep root

Answer

ls -la /home

Question 4

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Accepted Answer

Sysmon Event ID 3 (NetworkConnect) entries showing repeated connections to the same external IP at regular intervals.. Beaconing is characterized by repeated, regular communication from a host to an external controller. Sysmon network-connect events and DNS query events both capture the timing, destination, and initiating process needed to confirm that pattern directly from the endpoint. Logon, application-crash, and service-install events may support the broader investigation but do not, by themselves, demonstrate periodic outbound C2 traffic.

Answer

Application Event ID 1000 (Application Error) entries referencing a crashing service.

Answer

System Event ID 7045 (A service was installed in the system) recorded once during the investigation window.

Answer

Security Event ID 4624 (An account was successfully logged on) with Logon Type 3 repeated every few minutes.

Question 5

An examiner images a Windows 10 workstation and notices that several user profile folders are out of order in the \$MFT when sorted by MFT record number, yet the $STANDARD_INFORMATION timestamps are consistent. The examiner suspects that entries were reordered or that records were freed and reused. Which NTFS artifact best supports determining whether MFT record numbers have been reassigned to different files over time?

Accepted Answer

The $MFT record's sequence number, because it increments each time the record is allocated to a new file. The sequence number in an MFT file record is the key indicator of record reuse. It increases each time the record is allocated to a new file, so a higher sequence number than expected suggests the original file was deleted and the record was reassigned. Timestamps and $Bitmap do not preserve this allocation history.

Answer

The $STANDARD_INFORMATION attribute timestamps, because they are updated on every file access

Answer

The volume's $Bitmap file, because it tracks the allocation status of every MFT record

Answer

The $FILE_NAME attribute timestamps, because they persist across record reuse

Question 6

You are analyzing a system and find evidence that a user has executed a PowerShell script that imports the 'Net.WebClient' class. What is the most likely purpose of this script?

Accepted Answer

To download and execute a remote payload from a C2 server.. The 'Net.WebClient' class in .NET is frequently used in PowerShell to download remote content. In a forensic context, it is a hallmark of download-and-execute malware. Attackers use this to fetch secondary payloads from C2 servers. Identifying this class usage is critical for characterizing the scope of an attack, as it explains how the initial stub on the system was used to pull down more complex malicious tools.

Answer

To perform local file system encryption for data backup.

Answer

To monitor the system for unauthorized network connections.

Answer

To clear the Windows Event Logs to hide tracks.

Question 7

An analyst discovers a file named 'svchost.exe' in a user's AppData directory. Which artifact is the most reliable way to confirm if this file is a malicious masquerade rather than a legitimate system binary?

Accepted Answer

Verifying the digital signature of the file. Comparing the file's hash against known good values (e.g., from the National Software Reference Library) or checking digital signatures is standard forensic practice. Attackers often rename malicious binaries to match legitimate processes, but they cannot forge the cryptographic signature of a Microsoft-signed binary. If the file lacks a valid signature or has a mismatched hash, it confirms the binary is a malicious imposter intended to evade detection.

Answer

Checking the file creation time in the MFT

Answer

Searching for the process in the Shimcache

Answer

Viewing the process in Task Manager

Question 8

During a memory forensics investigation of a Windows 10 image, you suspect an attacker injected code into a legitimate process. Which TWO Volatility 3 plugins would you use together to detect and characterize the injected code? (Choose two.)

Accepted Answer

windows.vadinfo. windows.malfind finds executable memory regions not backed by a file, which is the signature of injected code, while windows.vadinfo provides the virtual address descriptor details for those regions, including protection and commit type. Using them together lets the analyst detect the injection and then characterize it as private, executable, and fileless within the target process.

Answer

windows.netscan

Answer

windows.handles

Answer

windows.registry.hivelist

Question 9

A forensic analyst is reviewing a Windows 10 system suspected of being infected with malware that maintains persistence. The analyst notices a new service named 'Windows Update Helper' with a binary path pointing to C:\Users\Public\updater.exe. The service is set to start automatically. Which artifact would best confirm that this service was created recently and is not a legitimate Windows service?

Accepted Answer

The SYSTEM registry hive, specifically the LastWrite time of the service key under HKLM\SYSTEM\CurrentControlSet\Services.. The LastWrite time of the service's registry key in the SYSTEM hive provides a direct timestamp for when the service configuration was last modified, which for a newly created service correlates with its installation. This artifact is stored locally and does not depend on audit policies. Other options either require non-default auditing, do not record service creation, or reflect file activity rather than service configuration.

Answer

The NTFS $MFT, checking the timestamps of the updater.exe file in C:\Users\Public.

Answer

The Amcache.hve file, checking for the service binary path under the Root\InventoryApplicationFile key.

Answer

The Security event log, looking for event ID 4697 (A service was installed in the system).

Question 10

An analyst discovers a file with a non-zero size but no data in the $DATA attribute. Where is the file content likely located?

Accepted Answer

The MFT record. In NTFS, small files are stored directly within the Master File Table (MFT) record as resident data. This is an optimization to save cluster space and reduce disk I/O. When the data attribute is resident, the content is part of the MFT entry itself, which is critical for investigators to understand when carving data, as standard file-based recovery tools might overlook these resident segments during deep analysis.

Answer

The $LogFile

Answer

The $Bitmap

Answer

The $Extend folder