GCFA Practice Test 7 — 10 Questions

Question 1

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

This is a network logon using NTLM that warrants correlation with source host and account baseline.. Logon Type 3 identifies a network logon, and the NTLM authentication package means the session did not use Kerberos. That alone is not proof of compromise, but it is a meaningful indicator that must be baselined against the account's normal source hosts, logon patterns, and downstream privilege events before any conclusion about credential theft or lateral movement is drawn.

Answer

This is normal service account behavior and no further review is needed.

Answer

This proves credential theft via Pass-the-Hash against the service account.

Answer

This indicates a successful interactive console logon by an attacker.

Question 2

When investigating a suspected fileless malware infection, you identify an anomaly in the 'PowerShell' Operational log. Which event ID indicates the execution of a base64 encoded command string often used to obfuscate malicious scripts?

Accepted Answer

Event ID 4104. Event ID 4104 records the execution of a script block. Attackers frequently use PowerShell's -EncodedCommand parameter to bypass simple string-based signature detection. By analyzing the content of these logs, specifically looking for long, base64-encoded strings, analysts can decode the hidden payloads and reconstruct the attacker's actions, which is vital for understanding the full scope of a fileless attack that avoids traditional disk-based indicators.

Answer

Event ID 4100

Answer

Event ID 4103

Answer

Event ID 400

Question 3

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Accepted Answer

Decode the base64 string and perform script analysis. The command line uses the '-enc' parameter, indicating a base64-encoded PowerShell script. Forensic analysts must decode this string to understand the attacker's intent. Once decoded, the analyst can identify the actual commands being run—such as downloading additional payloads or communicating with C2 servers. This is critical in modern incident response because obfuscation is a routine tactic to evade basic keyword-based monitoring and initial detection by security analysts.

Answer

Search for the process name in the Shimcache

Answer

Check the MFT for the parent process file

Answer

Run a system file integrity check

Question 4

An attacker is using a living-off-the-land (LotL) technique to execute commands on a Linux server. Which log source is most likely to reveal the command-line arguments used?

Accepted Answer

Linux Audit Framework (auditd).. Linux auditd is the most robust tool for capturing process execution details. By configuring auditd to watch the 'execve' system call, responders can log every command executed, including its arguments, by every user on the system. This is invaluable during an incident because LotL techniques often use standard, trusted binaries to perform malicious acts, and command-line arguments are the only evidence distinguishing legitimate administrative use from an attacker's malicious actions.

Answer

Syslog (/var/log/syslog).

Answer

Apache Access Logs.

Answer

X11 Display Logs.

Question 5

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Accepted Answer

Take snapshots of all attached volumes for forensic imaging.. Evidence preservation in cloud environments requires non-destructive methods that maintain chain of custody while ensuring data integrity. By creating snapshots, isolating the affected instance, and extracting memory, responders ensure that the state of the system is preserved for deep forensic analysis. These steps are crucial because cloud instances are ephemeral and can be easily deleted or modified, which would destroy the evidence necessary to build a complete incident timeline and identify the root cause.

Answer

Shut down the instance immediately to stop the attack.

Answer

Delete all ephemeral logs to save on cloud storage costs.

Question 6

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Accepted Answer

Event ID 4624 with Logon Type 10.. The Windows Security Event log captures specific Logon Types that categorize the nature of the authentication. Logon Type 2 denotes an interactive local login, while Type 10 identifies Remote Interactive (RDP) sessions. Scheduled tasks typically utilize Type 4 (Batch) or Type 5 (Service), allowing analysts to differentiate between user-driven activity and automated system processes through forensic inspection of the event data.

Answer

Event ID 4672 during the authentication process.

Answer

Event ID 4648 involving the use of explicit credentials.

Answer

Event ID 4720 occurring at the same time.

Question 7

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Accepted Answer

The usage of 'IEX' to execute code in memory.. The command performs an 'In-Process' download and execution of a remote PowerShell script. By using 'IEX' (Invoke-Expression) combined with a web client download, the attacker executes the script directly in memory, bypassing the need to write a file to disk. This is a highly effective evasion technique that leaves minimal forensic footprint and is a standard delivery method for sophisticated, memory-resident malware payloads.

Answer

The usage of the 'echo' command.

Answer

The creation of a text file in C:\Users\Public.

Answer

The command uses the 'hidden' window flag.

Question 8

When reviewing Windows Event Logs, which event ID indicates that a user has successfully performed an interactive login, and why is this critical for identifying unauthorized lateral movement?

Accepted Answer

Event ID 4624, because it captures the logon type and source workstation.. Event ID 4624 is the primary indicator of a successful logon. Analyzing Logon Type 2 (interactive) or Logon Type 10 (Remote Desktop) allows analysts to track user access patterns. Monitoring these events helps distinguish between routine administrative access and abnormal logins occurring at odd hours or from unusual source IPs, which are standard red flags for compromised credentials being used by threat actors to traverse the network.

Answer

Event ID 4688, because it tracks the exact time of user authentication.

Answer

Event ID 4720, because it logs user account creation activity.

Answer

Event ID 4625, because it confirms the user has successfully bypassed MFA.

Question 9

Why should a forensic analyst avoid using the 'Last Accessed' time as the primary indicator for a file's usage?

Accepted Answer

It is unreliable due to frequent updates by system services. The 'Last Accessed' timestamp is notoriously unreliable in forensic analysis because it is frequently updated by non-human system activity, such as antivirus scans or indexing services. Furthermore, many systems have the 'noatime' option enabled, which stops the OS from updating this field entirely. Because of this noise and potential for total absence, relying on this value for evidence of user activity is inherently dangerous and prone to producing false positives.

Answer

It is only updated if the file is moved to a different folder

Answer

It is the most easily forged timestamp in the MFT

Answer

It only exists on FAT32 file systems

Question 10

Which THREE items are typically stored in a thread's TEB (Thread Environment Block)?

Accepted Answer

Thread Local Storage (TLS) pointers. The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

Answer

Active process list pointer

Answer

Kernel-mode privilege level