GCFA Analyzing Volatile and Windows Event Artifacts Practice Test 3 — 15 Questions

Question 1

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 2

A GCFA analyst is reviewing a Windows 10 system and finds that the Security event log contains Event ID 4688 (process creation) entries, but the command line field is empty. The analyst needs to determine the full command line used by a suspicious process. Which configuration change, when enabled, would have populated the command line field in future Event ID 4688 entries?

Accepted Answer

Enable the 'Include command line in process creation events' policy under Administrative Templates > System > Audit Process Creation.. The 'Include command line in process creation events' policy is the specific setting that controls whether the command line is recorded in Event ID 4688. Enabling it ensures that future process creation events contain the full command line, which is essential for identifying malicious commands. Other audit policies enable the event but do not add command line data.

Answer

Enable the 'Turn on PowerShell Script Block Logging' policy under Administrative Templates > Windows Components > Windows PowerShell.

Answer

Enable the 'Process Creation' audit policy under Local Policies > Audit Policy.

Answer

Enable the 'Audit Process Creation' policy under Advanced Audit Policy Configuration > Detailed Tracking.

Question 3

You are examining a Windows Server 2019 memory image after a suspected credential-theft incident. You need to identify which process was used to access the LSASS process memory at the time of capture. Which Volatility 3 plugin and artifact combination most directly reveals handles opened to the LSASS process by other processes?

Accepted Answer

windows.handles, filtering for handles to the lsass.exe process object. Handle tables record which process opened an object and what type it is. Filtering the handle output for the lsass.exe process object pinpoints processes that held a handle to LSASS at capture time, which is strong evidence of memory access. Injected-memory, network, and loaded-module plugins examine other artifacts and do not answer who opened the handle.

Answer

windows.netscan, filtering for connections owned by lsass.exe

Answer

windows.dlllist, focusing on unsigned DLLs loaded into lsass.exe

Answer

windows.malfind, looking for PAGE_EXECUTE_READWRITE regions in lsass.exe

Question 4

A GCFA analyst is examining a Windows 10 memory image and wants to identify processes that were running when the image was captured, including those that may have terminated but left residual structures. The analyst uses Volatility 3. Which two plugins should the analyst use to enumerate processes from different sources? (Choose two.)

Accepted Answer

windows.pslist. windows.pslist enumerates processes from the active process list, while windows.psscan scans memory for process structures, which can uncover terminated or hidden processes. Using both provides a more comprehensive view of processes that were running or had recently terminated. The other plugins either rely on the same active list or serve different purposes.

Answer

windows.handles

Answer

windows.cmdline

Answer

windows.pstree

Question 5

A GCFA analyst is investigating a Windows Server 2019 system that was compromised via a PowerShell-based attack. The analyst has a memory image and the Windows event logs. The analyst wants to determine the exact PowerShell script block that was executed by a suspicious process. Which artifact or log source would provide the most direct evidence of the script block content?

Accepted Answer

Windows PowerShell event log, event ID 4104 (Script Block Logging).. Script Block Logging (event ID 4104) captures the actual PowerShell code that runs, including obfuscated or dynamically constructed script blocks, and writes it to the Windows PowerShell operational log. This is the most direct artifact for determining what a malicious PowerShell script did. Command-line auditing and memory plugins can show how PowerShell was launched but not the full script content. Therefore, the PowerShell event log with 4104 is the best source.

Answer

The windows.cmdline plugin output from the memory image showing the PowerShell process command line.

Answer

Windows Security event log, event ID 4688 (Process Creation) with command-line auditing enabled.

Answer

The windows.pslist plugin output showing the PowerShell process and its parent process.

Question 6

A Windows 10 endpoint was compromised, and the attacker cleared the Security event log after establishing persistence. You have a memory image captured after the clearing. Which Windows Event Log artifact can still provide evidence of the log-clearing action, even if the Security log entries were wiped?

Accepted Answer

System log Event ID 104. Clearing a log generates Event ID 1102 in the Security log and Event ID 104 in the System log. Because the Security log was erased, the 1102 entry is gone, but the System log's 104 entry usually remains and records the log name and the user who performed the clear. That surviving record is the key artifact for proving anti-forensic activity.

Answer

Security log Event ID 1102

Answer

Application log Event ID 1000

Answer

System log Event ID 6005

Question 7

A GCFA analyst is reviewing a Windows 10 memory image to identify user activity. The analyst wants to find the most recently typed commands in a command prompt window that was open at the time of acquisition. Which volatile artifact would provide this information?

Accepted Answer

The console history buffer in the conhost.exe process memory.. The console history buffer in conhost.exe memory contains the commands typed in a command prompt window during the session. This volatile artifact is not written to disk by default, so it can only be recovered from a memory image. The PSReadLine history file is for PowerShell and is persistent, while event logs and cmdline plugins do not capture interactive command history. Therefore, the conhost.exe buffer is the correct source.

Answer

The windows.cmdline plugin output showing the command line of cmd.exe.

Answer

The Windows Event Log 'Microsoft-Windows-CommandPrompt/Operational' with command history events.

Answer

The PowerShell console history file at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt.

Question 8

An analyst is reviewing a Windows 10 workstation that is suspected of being compromised by a fileless malware. The analyst has a memory image and wants to identify processes that have a thread start address pointing outside of any legitimate module. Which Volatility 3 plugin is most appropriate for this task?

Accepted Answer

windows.malfind. The malfind plugin is designed to detect hidden or injected code in memory by identifying memory regions that are both writable and executable and that lack a corresponding file on disk. It also reports the start address of threads within those regions. This makes it the correct choice for finding threads that start outside of legitimate modules, which is a common indicator of process injection or fileless malware.

Answer

windows.pslist

Answer

windows.cmdline

Answer

windows.netscan

Question 9

An analyst is investigating a suspected malware infection on a Windows Server 2016 system. The analyst reviews the Security event log and finds multiple Event ID 4688 entries for a process named 'svchost.exe' with a command line containing ' -k netsvcs -p -s Schedule'. The analyst wants to determine whether this is a legitimate service host process or a masquerading attempt. Which artifact should the analyst examine next to verify the integrity and origin of the executable?

Accepted Answer

The digital signature of the svchost.exe file. Verifying the digital signature of the executable is the most direct way to confirm whether svchost.exe is the legitimate Microsoft binary. A valid signature from Microsoft indicates the file is authentic and unmodified, while an invalid or missing signature suggests masquerading. Other artifacts like Prefetch, $MFT, and SRUM provide contextual information but do not verify integrity and origin.

Answer

The SRUM database entry for svchost.exe

Answer

The $MFT record for the svchost.exe file

Answer

The Prefetch file for svchost.exe

Question 10

An analyst is triaging a Windows 10 workstation suspected of a fileless malware infection. The analyst needs to quickly identify whether a specific process has an injected thread by examining volatile memory. Which Volatility 3 plugin should be used to list threads and their associated start addresses for a given process?

Accepted Answer

windows.threads. The windows.threads plugin enumerates threads within a process, showing start addresses that can be compared against known module ranges. Injected threads often have start addresses in unbacked memory, making this plugin ideal for detecting code injection. The other plugins focus on memory regions, handles, or loaded modules, none of which provide thread-level detail needed to identify an injected thread.

Answer

windows.dlllist

Answer

windows.handles

Answer

windows.malfind

Question 11

During a live-response investigation of a Windows 10 workstation, you need to determine which user account was interactively logged on at the console at the exact moment of the incident. Which artifact provides the most direct evidence of the currently active interactive session?

Accepted Answer

The Security event log entry 4624 with Logon Type 2 recorded at the time of the incident. An interactive logon is recorded as Security event 4624 with Logon Type 2, which is generated when a user authenticates at the console. Because the question asks who was actively logged on at the moment of the incident, that specific logon type is the most direct and reliable evidence, whereas logoff entries and profile hives persist or indicate termination rather than active presence.

Answer

The NTUSER.DAT registry hive loaded in the user's profile folder

Answer

The Security event log entry 4634 recording a logoff event

Answer

The Security event log entry 4647 recording a user-initiated logoff

Question 12

During an investigation of a compromised Windows Server 2019, an analyst extracts the ShimCache (AppCompatCache) from the SYSTEM registry hive. The analyst needs to determine which executable was present on the system but may have been deleted. Which artifact within the ShimCache entry provides the best indication of file existence and last modification time?

Accepted Answer

The file path and last modified timestamp. ShimCache entries include the file path and, on Windows 8+, a last modified timestamp from the file's $STANDARD_INFORMATION attribute. This timestamp helps determine when the file was last modified, and the presence of the path confirms the file existed. Execution flags and run counts are not part of ShimCache; those are in UserAssist or Prefetch. Process IDs and hashes are also not stored in ShimCache.

Answer

The SHA256 hash of the executable

Answer

The execution flag and run count

Answer

The process ID and parent process ID

Question 13

You are reviewing a Windows 10 host for evidence of process execution. A suspect binary was deleted from disk, but you need to prove it actually ran. Which artifact provides the strongest evidence that the specific executable was launched, independent of any prefetch or shimcache entries?

Accepted Answer

Security event 4688 with the New Process Name field populated for the binary. Event ID 4688 is generated by the Windows auditing subsystem at the instant a process is created, capturing the new process image path and, when command-line auditing is enabled, the full command line. Unlike ShimCache or Amcache, which can be populated by file presence or scanning, 4688 only appears when execution occurs, so it independently proves the suspect binary was launched.

Answer

A Prefetch file (.pf) containing the binary's name and run count in C:\Windows\Prefetch

Answer

The Amcache.hve entry containing the binary's SHA-1 hash and path

Answer

The AppCompatCache (ShimCache) entry for the binary in the SYSTEM hive

Question 14

During an investigation of a compromised Windows host, you review the Security event log and find Event ID 4624 with Logon Type 3. The account name is a domain service account, and the source network address is an internal server. You need to determine whether this represents a legitimate service authentication or an attacker using the account for lateral movement. Which additional event log detail is most critical to examine?

Accepted Answer

The Logon Process and Authentication Package fields in the 4624 event. For a Logon Type 3 event, the Logon Process and Authentication Package fields reveal the mechanism used. A service account authenticating via its normal service process and package looks routine; the same account authenticating with an unexpected package or from an unusual logon process suggests credential theft and lateral movement. The other fields support correlation but do not distinguish method as directly.

Answer

The Security ID (SID) of the account in the 4624 event

Answer

The Logon GUID field in the 4624 event

Answer

The Process ID and Process Name fields in the 4624 event

Question 15

An analyst is reviewing Windows Event Logs from a compromised workstation. The analyst observes Event ID 4688 (Process Creation) with the field 'Creator Process Name' showing 'C:\Windows\System32\cmd.exe' and the new process name showing 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'. Which of the following best describes what this event indicates?

Accepted Answer

A process named cmd.exe spawned a PowerShell process, which could indicate scripted or malicious activity.. Event ID 4688 includes the creator process name and new process name. In this case, cmd.exe created powershell.exe, indicating a parent-child relationship that is often seen in malicious scripts, such as those that use PowerShell for download or execution. While it could be benign, it is a suspicious pattern that should be investigated further. The other options either assume benign user action, introduce unsupported context, or reverse the relationship.

Answer

The system automatically started a PowerShell process as part of a scheduled task.

Answer

PowerShell was used to execute a command that created cmd.exe.

Answer

A user manually opened a command prompt and then launched PowerShell.