GCFA Practice Test 9 — 10 Questions

Question 1

Refer to the exhibit. An examiner observes the process tree provided. Given standard Windows operating system architecture, which specific observation indicates a high probability of malicious activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The parent-child relationship of svchost.exe and explorer.exe. The exhibit shows explorer.exe being spawned by svchost.exe. In a standard Windows environment, explorer.exe is spawned by userinit.exe, which in turn is spawned by winlogon.exe. A service host process (svchost.exe) spawning the Windows shell is highly anomalous behavior. This pattern suggests an injection or a process replacement attack where a malicious service has hijacked the shell or launched a secondary GUI interface for persistent command and control.

Answer

The PID 1240 is assigned to svchost.exe

Answer

The existence of two svchost.exe processes

Answer

The PID of explorer.exe is higher than svchost.exe

Question 2

What does a non-resident $DATA attribute indicate in an NTFS MFT record?

Accepted Answer

The file data is stored in separate clusters.. A non-resident $DATA attribute indicates that the actual file content is stored in external data clusters on the disk, rather than inside the MFT record. This is the standard behavior for most files. Analysts must understand this to correctly use data runs, which are pointers found within the $DATA attribute that tell the OS exactly where to find the file's fragmented pieces on the physical media.

Answer

The file is too small to be resident.

Answer

The file is corrupted.

Answer

The file is permanently deleted.

Question 3

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Accepted Answer

The memory segment is a malicious injection. The combination of PAGE_EXECUTE_READWRITE protection and the absence of an associated file (File: None) is a classic indicator of malicious code injection. Normal applications rarely allocate memory that is simultaneously writable and executable, as this violates standard security practices like Data Execution Prevention (DEP). The lack of a file-backing suggests the code resides entirely in memory, a common technique for fileless malware to avoid detection by traditional on-disk antivirus scanners.

Answer

The memory segment is a standard heap allocation

Answer

The memory segment is a legitimate shared library

Answer

The memory segment is part of the system kernel

Question 4

An examiner suspects that a system has been compromised with a rootkit that hooks kernel functions. Which memory forensics technique is most appropriate to detect this?

Accepted Answer

Verifying the SSDT function pointers. Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

Answer

Analyzing the process environment block (PEB)

Answer

Enumerating all running threads

Answer

Scanning for file system changes in the MFT

Question 5

What is the primary role of the $MFTMirr file in NTFS?

Accepted Answer

To provide a backup of the first MFT records.. The $MFTMirr file contains a backup of the first few records of the Master File Table. This is vital for filesystem recovery if the primary MFT record gets corrupted. For forensic analysts, the $MFTMirr provides a fail-safe that confirms the structure of the MFT and can sometimes contain remnants of file metadata that are useful when the primary MFT record has been damaged or maliciously altered.

Answer

To mirror all file contents.

Answer

To index all files in the system.

Answer

To store encrypted file keys.

Question 6

An analyst discovers a suspicious executable in the C:\Users\Public folder. To determine if the file was executed, the analyst examines the Shimcache. Which behavior is characteristic of the Shimcache artifact?

Accepted Answer

It tracks file path and last modification time for potential application compatibility.. The Shimcache, or AppCompatCache, tracks file metadata to ensure application compatibility. Crucially, it tracks file paths and last modified times but does not natively record the exact execution timestamp of an application. It is primarily used to identify files that were present on the system and potentially executed, serving as a critical indicator of software presence during an investigation into lateral movement or malware persistence on a Windows endpoint.

Answer

It records the exact UTC execution time for all files in the SYSTEM hive.

Answer

Entries are only populated when the UserAssist key is enabled in the registry.

Answer

It is stored within the NTUSER.DAT hive for each individual user profile.

Question 7

An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?

Accepted Answer

$I file. In Windows 10, each deleted file in the Recycle Bin has a corresponding $I file that stores the original path, deletion time, and file size. The $R file contains the actual data. The $Recycle.Bin folder is the container, and INFO2 is obsolete. Therefore, the $I file is the correct artifact to examine.

Answer

INFO2 file

Answer

$Recycle.Bin folder

Answer

$R file

Question 8

An analyst is examining an NTFS volume and notices that a file's MFT entry shows a modification time earlier than its creation time. What is the most likely cause for this anomaly?

Accepted Answer

The file was moved from another volume or manipulated using timestomping techniques.. This anomaly is frequently caused by the 'timestomping' technique or a file move operation where the original metadata is preserved. By understanding file system internals, an analyst recognizes that MFT entry times are susceptible to manipulation via user-mode tools or low-level API calls. Detecting these inconsistencies is critical for identifying anti-forensics activity or specific file system behaviors that could lead to misinterpretation of the true timeline of events.

Answer

The file system is corrupted and requires an immediate CHKDSK operation.

Answer

The operating system experienced a clock drift during the file write process.

Answer

The master file table is using short filename (8.3) format which ignores creation time.

Question 9

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Accepted Answer

The process with PID 4820.. The exhibit shows two active connections. The first is a standard SMB connection, but the second, PID 4820, connects to an external IP on port 443. This is highly suspicious for a server that should not have direct outbound HTTPS communication to an unknown external host. Identifying the process associated with PID 4820 allows the analyst to trace the activity back to the binary responsible for the unauthorized external communication, which is a key indicator of C2 traffic.

Answer

The process with PID 4.

Answer

The connection to 10.10.1.5.

Answer

The SMB connection on port 445.

Question 10

An analyst is reviewing a Windows 10 workstation that is suspected of being compromised by a fileless malware. The analyst has a memory image and wants to identify processes that have a thread start address pointing outside of any legitimate module. Which Volatility 3 plugin is most appropriate for this task?

Accepted Answer

windows.malfind. The malfind plugin is designed to detect hidden or injected code in memory by identifying memory regions that are both writable and executable and that lack a corresponding file on disk. It also reports the start address of threads within those regions. This makes it the correct choice for finding threads that start outside of legitimate modules, which is a common indicator of process injection or fileless malware.

Answer

windows.pslist

Answer

windows.cmdline

Answer

windows.netscan