GCFA Practice Test 8 — 10 Questions

Question 1

Which memory artifact is most useful for identifying the specific user account associated with a suspicious process?

Accepted Answer

The process security token. In Windows, every process is associated with a security token object that defines the user's identity, privileges, and groups. By extracting the security token structure associated with an EPROCESS object in memory, an analyst can determine the exact user context under which the process is executing. This is vital for determining if a process was launched with system privileges or by a compromised local user account during an incident.

Answer

The thread environment block (TEB)

Answer

The process environment block (PEB)

Answer

The registry hive file for the user

Question 2

Which attribute is used to store the location and length of file data runs in an NTFS MFT record?

Accepted Answer

$DATA. The $DATA attribute is responsible for storing the file's content or references to the clusters where the data resides on the disk. When the file is too large to be resident, the $DATA attribute contains 'data runs'—compacted descriptions of the starting cluster and the number of consecutive clusters allocated to the file, which the driver uses to read the file data.

Answer

$FILE_NAME

Answer

$INDEX_ROOT

Answer

$ATTRIBUTE_LIST

Question 3

What is the primary function of the ShellBags artifact in a Windows forensic investigation?

Accepted Answer

To demonstrate that a user navigated to a specific folder.. ShellBags are registry entries that store folder view preferences, such as window size, icon position, and folder sorting. For forensics, they are incredibly useful for proving that a user navigated to a specific directory in Windows Explorer. This is critical for demonstrating user intent, as it shows which folders were browsed, even if those folders were later deleted or were located on removable media that is no longer connected.

Answer

To track the history of web browser searches.

Answer

To log file deletion events in the Recycle Bin.

Answer

To record the last time a system was rebooted.

Question 4

An incident responder is reviewing EDR alerts and discovers an 'Account Manipulation' event. What is the most common reason why an attacker would target the 'Domain Admins' group during the post-exploitation phase?

Accepted Answer

To gain unrestricted control over the entire domain and its resources.. Targeting the Domain Admins group is the 'holy grail' for an attacker because it provides full control over the entire Active Directory domain. With these privileges, an attacker can disable security controls, create new accounts, exfiltrate sensitive data, and install persistent backdoors across all systems joined to the domain. This level of access effectively grants the attacker the ability to operate undetected and exert complete influence over the organization's enterprise infrastructure.

Answer

To bypass the need for multi-factor authentication on local machines.

Answer

To encrypt the Active Directory database for ransomware demands.

Answer

To hide their tracks by clearing the Windows Event logs globally.

Question 5

Which of the following describes the 'Principle of Least Privilege' applied to incident response accounts?

Accepted Answer

Limiting IR account access to only the specific data and systems needed for the investigation.. Using dedicated, limited-scope accounts for incident response ensures that if the responder's account is compromised, the attacker does not gain enterprise-wide administrative access. By providing only the permissions necessary for the investigation—such as read-only access to logs or forensic imaging permissions—the risk of accidental or malicious damage to the production environment is minimized, ensuring that the integrity of the IR process remains intact even in a hostile or complex environment.

Answer

Using a Domain Admin account for all investigation tasks to avoid access issues.

Answer

Granting forensic responders full system access to all network segments.

Answer

Ensuring all IR accounts have a shared password for rapid response coordination.

Question 6

During a forensic investigation of an NTFS volume, an analyst notices that the $MFT record for a suspicious executable shows a modified time earlier than its creation time. What does this specific anomaly typically indicate?

Accepted Answer

The file was copied from another location, preserving the original modified timestamp while generating a new creation timestamp.. An $MFT record reflecting a modified time earlier than the creation time frequently occurs when a file is copied rather than moved. The copy operation assigns a new creation timestamp to the destination file while preserving the original modified timestamp from the source file. Recognizing this artifact helps forensic analysts trace the origin of stolen payloads across network shares or external drives.

Answer

The file system metadata was actively corrupted by malware to hinder timeline analysis.

Answer

The operating system experienced a severe clock synchronization failure during the write operation.

Answer

An automated defragmentation utility reorganized the cluster chain and inadvertently swapped the metadata values.

Question 7

During a response to an incident involving a web shell, you find that the attacker is using custom encoding to bypass WAF signatures. What is the best forensic approach to identify all impacted web files?

Accepted Answer

Perform a file integrity check against the original source code base.. When attackers use custom encoding to hide web shells, signature-based WAF detections are ineffective. The most robust method is to perform a differential analysis of the web application's codebase against a known-good baseline, such as the original source control repository. By automatically highlighting differences, you can identify injected code blocks that don't match authorized files, regardless of how they are encoded or obfuscated by the attacker during the injection process.

Answer

Run a regex-based search for common web shell function names.

Answer

Analyze WAF logs to identify all requests that resulted in 200 OK codes.

Answer

Examine the access logs for all requests containing encoded characters.

Question 8

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Accepted Answer

Timestomping. Attackers utilize anti-forensic techniques to break the chain of evidence. Timestomping specifically invalidates the reliability of file metadata, while log clearing removes the context required for correlation. Both techniques force analysts to move deeper into secondary artifacts like the USN Journal or volume shadow copies, significantly increasing the time and complexity of an investigation while testing the analyst's ability to cross-reference multiple data sources for evidence.

Answer

Updating system drivers

Answer

Using a web browser

Answer

Renaming a file

Question 9

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Accepted Answer

Discrepancies often reveal timestomping attempts by attackers.. The MFT contains two primary timestamps for each file: Standard Information (SI) and File Name (FN). Attackers often use 'timestomping' tools to modify the SI attributes to match legitimate files and hide their tracks. However, they frequently forget or are unable to modify the FN attributes, which are less accessible. Discrepancies between these timestamps are a definitive indicator of anti-forensic activity that analysts use to uncover hidden malicious file creation times.

Answer

SI attributes are updated by the OS, while FN attributes are static.

Answer

FN attributes are the only way to recover deleted files.

Answer

SI attributes are required for NTFS file permissions.

Question 10

An analyst is preparing to acquire memory from a compromised server. Which TWO of the following factors are the most critical to consider regarding the integrity of the evidence and system stability?

Accepted Answer

The footprint of the acquisition tool in RAM. When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

Answer

The bit-depth of the monitor attached to the server

Answer

The total capacity of the hard drive

Answer

The current time zone of the server