GCFA Analyzing Volatile and Windows Event Artifacts Practice Test 2 — 15 Questions

Question 1

An analyst is investigating a suspected malware infection on a Windows 10 endpoint. The analyst has obtained a memory image and wants to identify processes that may be masquerading as legitimate system processes. Which two of the following techniques should the analyst use to detect process masquerading in the memory image? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine the parent-child process relationships for anomalies.. To detect process masquerading in a memory image, comparing the process path to expected system paths and examining parent-child relationships are effective. Legitimate system processes run from specific directories and have predictable parents. Discrepancies in path or parent can indicate masquerading. Digital signature checks, malfind, and looking for misspellings are either not directly applicable, focus on injection rather than masquerading, or are less reliable than path and parent analysis.

Answer

Use the windows.malfind plugin to locate hidden or injected code.

Answer

List all processes and look for names that are similar to legitimate ones but with slight misspellings.

Answer

Check the digital signature of each process's executable in memory.

Question 2

Which conclusion regarding this network logon event is most accurate based on the provided Windows Event Log details?

Accepted Answer

The authentication utilized NTLMv1 or failed to negotiate encryption. A Logon Type 3 indicates a network logon, typically associated with accessing a shared resource or remote service. The 'NtLmSsp' package signifies NTLM authentication, and the Key Length of 0 indicates that NTLMv1 is being used or encryption is absent. This suggests a legacy or potentially insecure authentication attempt, which is a common indicator of lateral movement using outdated protocols that are susceptible to relay attacks.

Answer

The user performed an interactive console logon

Answer

The event represents a Kerberos ticket granting service request

Answer

The account was locked out due to excessive attempts

Question 3

When investigating a suspected fileless malware infection, you identify an anomaly in the 'PowerShell' Operational log. Which event ID indicates the execution of a base64 encoded command string often used to obfuscate malicious scripts?

Accepted Answer

Event ID 4104. Event ID 4104 records the execution of a script block. Attackers frequently use PowerShell's -EncodedCommand parameter to bypass simple string-based signature detection. By analyzing the content of these logs, specifically looking for long, base64-encoded strings, analysts can decode the hidden payloads and reconstruct the attacker's actions, which is vital for understanding the full scope of a fileless attack that avoids traditional disk-based indicators.

Answer

Event ID 4100

Answer

Event ID 4103

Answer

Event ID 400

Question 4

Which THREE items are critical to inspect when analyzing a memory dump for evidence of Process Hollowing or Injection?

Accepted Answer

Memory Page Permissions (RWX). Process injection techniques often modify memory protections or inject code into existing legitimate processes. By comparing the disk-based image of a process with its memory-based representation, analysts can identify discrepancies in executable sections. Checking memory protections (e.g., RWX permissions) and identifying unbacked executable code in private memory regions are the primary methods for uncovering sophisticated persistent threats that operate entirely within the volatile memory space.

Answer

The system's Event Log files

Answer

The MFT file records

Question 5

Based on the process metadata provided in the exhibit, what is the most significant indicator that requires further investigation?

Accepted Answer

The ParentPID value. The process name 'svchost.exe' is a common target for masquerading. While the path seems correct, the Parent Process ID (PPID) is the critical indicator. A legitimate svchost.exe should always be spawned by 'services.exe'. If the PPID 567 points to an unexpected process, such as an explorer.exe or a temporary file, it indicates a potential process masquerading or injection attempt, warranting immediate deep-dive analysis of that parent process.

Answer

The command line contains -k netsvcs

Answer

The process path is C:\Windows\System32\

Answer

The process name is svchost.exe

Question 6

When analyzing a memory capture, you notice a process has a 'hidden' network connection. Which artifact provides the best view of active network connections linked to specific process IDs?

Accepted Answer

TCP Endpoint structures. The TCP Endpoint structures in kernel memory are essential for mapping network activity to process ownership. Attackers often attempt to hide connections using rootkit techniques, but these structures in memory usually remain accurate. Linking a specific PID to a remote IP address allows the analyst to identify Command and Control (C2) communication, which is the most reliable way to identify an active, compromised host during a live incident response.

Answer

DNS cache

Answer

Shimcache

Answer

Amcache.hve

Question 7

An analyst suspects that an attacker used WMI (Windows Management Instrumentation) to execute code remotely. Which log file should be examined to confirm WMI-based process creation?

Accepted Answer

WMI-Activity/Operational.evtx. The 'Microsoft-Windows-WMI-Activity/Operational' log is the primary source for tracking WMI interactions. WMI is frequently abused for lateral movement because it allows for stealthy, authenticated command execution. By reviewing these specific operational logs, analysts can correlate WMI provider activity with process creation events, confirming whether a remote actor utilized WMI to launch malicious processes on the target system without needing an interactive shell session.

Answer

Security.evtx

Answer

System.evtx

Answer

Application.evtx

Question 8

An analyst discovers a file named 'svchost.exe' in a user's AppData directory. Which artifact is the most reliable way to confirm if this file is a malicious masquerade rather than a legitimate system binary?

Accepted Answer

Verifying the digital signature of the file. Comparing the file's hash against known good values (e.g., from the National Software Reference Library) or checking digital signatures is standard forensic practice. Attackers often rename malicious binaries to match legitimate processes, but they cannot forge the cryptographic signature of a Microsoft-signed binary. If the file lacks a valid signature or has a mismatched hash, it confirms the binary is a malicious imposter intended to evade detection.

Answer

Checking the file creation time in the MFT

Answer

Searching for the process in the Shimcache

Answer

Viewing the process in Task Manager

Question 9

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Accepted Answer

Decode the base64 string and perform script analysis. The command line uses the '-enc' parameter, indicating a base64-encoded PowerShell script. Forensic analysts must decode this string to understand the attacker's intent. Once decoded, the analyst can identify the actual commands being run—such as downloading additional payloads or communicating with C2 servers. This is critical in modern incident response because obfuscation is a routine tactic to evade basic keyword-based monitoring and initial detection by security analysts.

Answer

Search for the process name in the Shimcache

Answer

Check the MFT for the parent process file

Answer

Run a system file integrity check

Question 10

Which artifact is the primary location for finding 'Shellbag' data, which tracks user folder access history?

Accepted Answer

NTUSER.DAT hive. Shellbags are stored in the NTUSER.DAT registry hive. They provide an invaluable record of which folders a user has opened and the specific view settings applied to those folders. This artifact is critical for forensic investigations because it proves user presence in specific directories, which can be used to link a user account to the staging of malicious files or the browsing of sensitive data during an incident.

Answer

SYSTEM hive

Answer

SOFTWARE hive

Answer

SAM hive

Question 11

An analyst is examining a memory capture to identify malicious code injection. Which volatility plugin would best help determine if a process has been hollowed by inspecting the base address and the VAD (Virtual Address Descriptor) properties of the memory segments?

Accepted Answer

malfind. The malfind plugin is the standard tool for identifying injected code by scanning for memory segments with Execute/Read/Write permissions that are not backed by a file on disk. This is a critical step in volatile memory analysis because malware often uses process hollowing to hide its execution flow within legitimate system processes. Comparing VAD protections helps confirm the anomaly, which is a hallmark of sophisticated persistent threats evading standard file-based detection.

Answer

pslist

Answer

handles

Answer

pstree

Question 12

Which of the following best describes the function of the 'UserAssist' registry key in a Windows forensic investigation?

Accepted Answer

Tracks the execution of GUI-based applications for each user.. UserAssist records information about GUI-based programs executed by a user, including the file path, execution count, and last execution time. It is stored in the user's NTUSER.DAT hive. This artifact is essential for determining user activity, establishing which applications were launched, and identifying the persistence of specific malicious binaries across sessions. It helps investigators prove that a specific user was responsible for launching an application, which is crucial for attribution.

Answer

Tracks all system-wide driver installations and updates.

Answer

Records the last time a user logged onto the system.

Answer

Stores the history of web browsing sessions in Internet Explorer.

Question 13

Which Volatility plugin would be most effective for extracting the command-line arguments of a process to identify malicious flags used during execution?

Accepted Answer

cmdline. The 'cmdline' plugin in Volatility 2 or the equivalent 'windows.cmdline' in Volatility 3 is essential for surfacing the exact arguments used to launch a process. Attackers frequently use command-line arguments to pass encoded payloads, configure malicious scripts, or perform lateral movement tasks. Identifying these arguments provides the context necessary to understand the intent of the process, which is often hidden when looking only at the process name or binary path.

Answer

pstree

Answer

netscan

Answer

dlllist

Question 14

During a forensic investigation of a Windows 10 system, an analyst examines a memory dump and finds a process named 'svchost.exe' with a parent process ID (PPID) of 1234. The analyst runs 'vol -f memory.dmp windows.pslist' and sees that PID 1234 is not present in the output. Which of the following conclusions is most likely correct?

Accepted Answer

The parent process has terminated, and the PPID is now stale.. When a parent process terminates, its child processes continue to run, and the child's PPID remains set to the now-invalid parent PID. This results in a stale PPID. The absence of PID 1234 in the active process list indicates that the parent has likely terminated, which is a normal occurrence and not inherently malicious.

Answer

The memory dump is corrupted and the process list is incomplete.

Answer

The process 'svchost.exe' is a known Windows service and its parent should always be 'services.exe'.

Answer

The PPID indicates that the parent process is hidden by a rootkit and should be recovered using psscan.

Question 15

During a live response on a Windows 10 workstation suspected of lateral movement, you capture volatile memory and also export the Windows Event Logs. You need to correlate a process that was running at the time of capture with its parent process and the user account that launched it, using only the memory image. Which Volatility 3 plugin should you run to produce a parent-child process tree with PID/PPID, image name, and offset columns?

Accepted Answer

windows.pstree. The goal is a parent-child process tree with PID, PPID, and image name from a memory image. The pstree plugin is purpose-built for that: it traverses the active process list and renders indentation that shows lineage. Other plugins either list processes flatly, hunt for hidden or terminated objects, or resolve SIDs, none of which produce the tree structure required here.

Answer

windows.getsids

Answer

windows.pslist

Answer

windows.psscan