GCFA Enterprise Environment Incident Response — 20 Questions

Question 1

An incident responder identifies a suspicious PowerShell process executing encoded commands on an enterprise server. To effectively contain the host while preserving volatile evidence for forensic analysis, which action should the responder prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture a memory image using a trusted forensic tool before isolating the machine.. Prioritizing memory acquisition before pulling the plug is critical in incident response. Memory contains the decoded PowerShell script, process injection artifacts, and ephemeral network connections that disappear upon power loss. In an enterprise setting, using a live response toolkit to capture RAM ensures that the chain of custody for volatile data is maintained, allowing for a thorough analysis of the threat actor's tactics, techniques, and procedures without destroying the evidence.

Answer

Immediately disconnect the network cable to prevent further C2 communication.

Answer

Perform a remote shutdown of the host to ensure the system is in a known safe state.

Answer

Update the host's antivirus signature and run a full system scan.

Question 2

Refer to the exhibit. An analyst observes this process entry on a server that has triggered a high-severity alert. Based on the provided metadata, why is this process considered highly suspicious?

Accepted Answer

The process is initiating an external network connection to a remote IP.. The exhibit shows svchost.exe initiating an external network connection to a private IP address range that is not standard for system-level services. While svchost.exe is a legitimate Windows process, it should not be initiating outgoing TCP connections to external or non-standard internal addresses. This indicates potential process injection or masquerading, which is a common technique used by threat actors to hide malicious activity within legitimate system processes for stealthy persistence and communication.

Answer

The process is running under the SYSTEM account, which indicates privilege escalation.

Answer

The command line arguments are malformed and missing necessary system flags.

Answer

The process ID (PID) is unusually high, suggesting it was recently spawned by an attacker.

Question 3

When conducting an enterprise incident response, why is it essential to establish a dedicated Out-of-Band (OOB) communication channel?

Accepted Answer

It ensures that the incident response team remains invisible to the attacker.. An OOB channel ensures that the incident response team can communicate securely without the attacker, who may have compromised the internal email or collaboration platform, eavesdropping on the planning and containment efforts. If an attacker has access to internal communication tools, they can anticipate the responder's moves and adjust their tactics accordingly. Maintaining secrecy through an independent, verified communication path is critical to keeping the response effort ahead of the adversary.

Answer

It provides a backup for internal systems in case of a total network outage.

Answer

It is required by industry regulations like PCI-DSS and HIPAA for all incidents.

Answer

It allows the team to invite third-party forensics firms to join the call.

Question 4

Refer to the exhibit. An analyst is investigating a suspected breach. Given the log entries, which immediate hypothesis is most supported by the evidence?

Accepted Answer

The attacker has achieved persistence and is performing privilege escalation.. The logs show a service installation using a binary located in a temporary directory, followed by the execution of a base64-encoded PowerShell command. The path 'C:\Windows\Temp' is a classic indicator of malicious activity, as legitimate system binaries reside in System32. The PowerShell command likely performs user enumeration or adds an attacker-controlled account, suggesting the attacker has achieved persistence and is now moving to escalate privileges and expand their footprint within the enterprise environment.

Answer

The administrator is performing routine maintenance on the server.

Answer

The server has been compromised by an automated worm spreading via SMB.

Answer

The PowerShell command was an automated log cleanup task.

Question 5

An incident responder identifies an active PowerShell script executing encoded commands in memory. Which memory forensics technique is most effective for extracting the deobfuscated script content during the live response phase?

Accepted Answer

Perform a process memory dump and carve for strings or use specialized reconstruction tools.. Memory forensics is critical for capturing ephemeral evidence like injected code or obfuscated scripts that reside only in RAM. By dumping the process memory of the PowerShell host and running automated string analysis or memory carving tools, responders can recover the deobfuscated payload. This is essential because attackers often use memory-resident techniques to evade disk-based signature detection, making live memory analysis a primary tool for modern threat hunting and incident response.

Answer

Analyze the MFT for recent PowerShell script file modifications.

Answer

Capture and analyze the system's prefetch files for execution history.

Answer

Examine the Windows Event Logs for PowerShell script block logging.

Question 6

An incident responder discovers an attacker using Domain Fronting to bypass network egress filtering. What is the most effective way to mitigate this technique at the perimeter?

Accepted Answer

Implement TLS inspection to validate the SNI and Host headers.. Domain fronting relies on the discrepancy between the SNI (Server Name Indication) field in the TLS handshake and the Host header inside the encrypted request. Perimeter firewalls cannot inspect the encrypted payload to see the Host header. By implementing strict TLS inspection (man-in-the-middle) at the egress proxy, the organization can decrypt traffic, inspect the true Host header, and drop requests where the SNI and Host header do not match, effectively blocking the fronting attempt.

Answer

Block all traffic to the specific destination IP addresses.

Answer

Restrict DNS queries to only known internal domain names.

Answer

Enable Geo-IP blocking to prevent traffic to foreign countries.

Question 7

Which THREE of the following represent common artifacts of lateral movement found during a Windows investigation?

Accepted Answer

Presence of PSEXEC service binaries in the Windows directory.. Lateral movement often involves abusing legitimate administrative tools to transition between hosts. Attackers frequently leverage SMB shares for file transfer, use WMI or PSEXEC for remote execution, and perform credential harvesting in memory. Identifying these artifacts provides a clear trail of the attacker's path through the network, allowing responders to map the scope of the compromise and identify which systems require remediation or forensic imaging to ensure the environment is fully cleaned.

Answer

Excessive failed logins using the local Administrator account.

Answer

Increase in standard daily outbound web traffic metrics.

Question 8

Which phase of the incident response lifecycle focuses on identifying the root cause and determining if the incident is ongoing?

Accepted Answer

Detection and Analysis.. The Detection and Analysis phase is where the incident response team determines the nature of the event, verifies its validity, and identifies the scope and root cause. This phase is critical because it dictates the entire subsequent response strategy. Without a proper understanding of the root cause, containment efforts may be ineffective or lead to 'whack-a-mole' scenarios where the attacker easily re-establishes access because the initial entry point was not fully identified or remediated.

Answer

Preparation.

Answer

Containment, Eradication, and Recovery.

Answer

Post-Incident Activity.

Question 9

During an enterprise-wide incident, you are tasked with collecting volatile evidence from hundreds of compromised Windows 10 endpoints. Which approach best preserves the integrity and order of volatile data while enabling centralized analysis?

Accepted Answer

Deploy a lightweight agent that captures memory, network connections, and process lists in a predefined order, encrypts the data, and stores it locally for later collection.. Deploying a lightweight agent that collects volatile data in a predefined order, encrypts it, and stores it locally preserves the order of volatility and ensures integrity across many endpoints. Centralized later collection enables efficient analysis without network dependencies or system alteration, which is critical in enterprise incident response.

Answer

Instruct users to run a provided batch file that collects system information and emails it to the incident response team.

Answer

Remotely execute a PowerShell script that collects memory, network connections, and running processes, then writes the output to a network share.

Answer

Use a commercial forensic suite to create a full disk image of each endpoint, then extract volatile data from the images.

Question 10

An enterprise incident response team is investigating a breach involving a compromised domain controller. The attacker used Kerberos ticket manipulation to maintain persistence. Which TWO of the following forensic artifacts should be prioritized for collection to identify the compromised accounts and the persistence mechanism? (Choose two.)

Accepted Answer

Security event log (Event ID 4768, 4769, 4771). Security event logs and Kerberos ticket caches are essential for detecting Kerberos ticket manipulation. Event logs provide a historical audit trail of ticket requests, while the ticket cache shows active tickets that may be forged. Together, they help identify compromised accounts and the persistence mechanism without relying on volatile memory or less specific artifacts.

Answer

NTDS.dit database file

Answer

LSASS process memory dump

Answer

Registry hives (SYSTEM, SAM, SECURITY)

Question 11

An incident responder is analyzing a memory dump from a Windows 10 host compromised by a sophisticated adversary. The adversary used process hollowing to inject malicious code into a legitimate process. Which Volatility 3 plugin is most appropriate to detect the hollowed process by comparing the in-memory image of the executable with its on-disk counterpart?

Accepted Answer

windows.hollowfind. Process hollowing involves unmapping the legitimate executable code from a process and replacing it with malicious code. The windows.hollowfind plugin in Volatility 3 compares the in-memory PE image with the on-disk file to detect such tampering. This makes it the most appropriate tool for identifying hollowed processes in a memory dump.

Answer

windows.dlllist

Answer

windows.malfind

Answer

windows.psscan

Question 12

During an enterprise incident response engagement, a responder is collecting volatile data from a compromised Windows Server 2019 system before initiating a full disk image. The responder needs to capture the current list of network connections, associated process IDs, and the executable paths responsible for each connection. Which single Windows-native command should the responder run to reliably obtain this information on the live system?

Accepted Answer

Get-NetTCPConnection -State Established | ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; [PSCustomObject]@{Local=$_.LocalAddress;Remote=$_.RemoteAddress;PID=$_.OwningProcess;Path=$p.Path} }. The requirement is to correlate live network connections with the executable path of the owning process in a single reliable operation. Enumerating established TCP connections and resolving each owning process ID to its image path accomplishes this natively in PowerShell. Commands that show only PIDs or only process paths leave a gap, forcing manual correlation that risks missing short-lived connections during volatile data collection.

Answer

Get-Process | Select-Object Id,ProcessName,Path

Answer

netstat -ano

Answer

Get-NetTCPConnection -State Established | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess

Question 13

During an incident, you need to acquire volatile memory from a running Windows 10 workstation suspected of malware infection. The system is in a locked state, and you cannot log in interactively. Which method is most appropriate to capture memory while minimizing alteration of the system state?

Accepted Answer

Use a hardware-based memory acquisition device over Thunderbolt or PCIe.. When a system is locked and interactive access is unavailable, hardware-based memory acquisition is the most appropriate method. It bypasses the operating system entirely, capturing physical memory without altering the system state. Software tools require execution on the host, which is not possible without login. Process dumps are insufficient for full memory analysis. Hardware acquisition ensures a complete and forensically sound capture.

Answer

Use WinPmem to capture memory via a remote PowerShell session.

Answer

Use Magnet RAM Capture via a physical USB device and autorun script.

Answer

Use the built-in Task Manager to create a memory dump of the suspicious process.

Question 14

A security analyst is reviewing network traffic logs and notices a large volume of outbound traffic from an internal server to an unknown external IP address on port 443. The traffic occurs regularly every 60 seconds and the payload size is consistent. The analyst suspects command-and-control (C2) communication. Which of the following techniques is the adversary MOST likely using to evade detection?

Accepted Answer

Beaconing with jitter. The regular, periodic outbound traffic to an unknown external IP on port 443 is characteristic of beaconing, a common C2 technique where malware checks in with its controller at set intervals. This pattern helps the adversary maintain persistence and receive commands while blending in with normal HTTPS traffic. The consistent interval and payload size suggest a basic beacon, which is a primary method for C2 communication.

Answer

Tunneling C2 over DNS

Answer

Using a fast flux network

Answer

Domain fronting

Question 15

During an enterprise incident response, you discover that an attacker used a scheduled task to maintain persistence on a Windows Server 2019 host. The task is configured to run a malicious script every hour. Which artifact should you examine to determine the exact command line and the user account under which the task runs?

Accepted Answer

The Windows registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks. The TaskCache registry key under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks contains the XML definitions of all scheduled tasks. This includes the exact command line, arguments, and the user account (Principal) configured to run the task. This makes it the definitive artifact for analyzing scheduled task persistence and understanding the attacker's actions.

Answer

The Security event log for event ID 4698 (A scheduled task was created)

Answer

The file system path C:\Windows\System32\Tasks

Answer

The Task Scheduler event log (Microsoft-Windows-TaskScheduler/Operational.evtx)

Question 16

An enterprise incident response team is preparing to acquire volatile evidence from a compromised Windows server. The server is running critical business applications, and management wants to minimize downtime. Which TWO of the following actions should the team perform to properly capture volatile data while preserving system integrity? (Choose two.)

Accepted Answer

Run 'netstat -anob' to record active network connections and associated process IDs.. Capturing physical memory preserves the most volatile evidence, including running processes and network connections. Recording network connections with netstat provides a live snapshot of command-and-control activity. Both actions are non-destructive and do not require downtime, making them appropriate for live response on a critical server. Shutting down, disconnecting, or running antivirus would either destroy evidence or disrupt operations.

Answer

Immediately shut down the server to prevent further attacker actions.

Answer

Disconnect the server from the network to isolate it.

Answer

Run a full antivirus scan to remove any malware.

Question 17

An incident responder is analyzing a memory dump from a compromised Windows 10 workstation. The attacker used a fileless malware technique that injected malicious code into a legitimate process. The responder needs to identify the injected code and the process it is running in. Which of the following memory forensics techniques is MOST appropriate for this task?

Accepted Answer

Analyzing process hollowing by comparing disk and memory images. Process hollowing involves replacing the memory of a legitimate process with malicious code. Comparing the in-memory image of a process with its corresponding executable on disk reveals discrepancies, such as missing sections or altered code. This technique directly identifies the hollowed process and the injected payload, making it the most appropriate for this scenario.

Answer

Scanning for known malicious strings

Answer

Examining the Master File Table (MFT) for alternate data streams

Answer

Checking the Windows event logs for process creation events

Question 18

During a post-incident review, a team realizes they missed a critical indicator of compromise (IOC) because they did not normalize their log data. What is the primary benefit of log normalization in an enterprise incident response environment?

Accepted Answer

It enables cross-platform correlation by providing a consistent event schema.. Log normalization transforms heterogeneous data from various vendors, formats, and sources into a standardized schema. This allows security tools to correlate events across the environment, such as matching a Windows Security log event to a Cisco firewall connection. Without normalization, analysts spend significant time manually parsing logs, which delays detection and increases the likelihood of missing subtle, multi-stage attack patterns that occur across disparate systems during an enterprise-wide security breach.

Answer

It removes sensitive PII from logs to ensure regulatory compliance.

Answer

It compresses log files, reducing storage costs for long-term retention.

Answer

It automatically blocks malicious traffic detected within the log streams.

Question 19

Which phase of the incident response lifecycle is most directly responsible for ensuring that an enterprise environment is returned to a secure, verified state after an intrusion?

Accepted Answer

Recovery. The recovery phase is where the focus shifts from stopping the bleeding to restoring business operations securely. This involves verifying that all backdoors have been closed, credentials have been rotated, and systems are patched against the initial vulnerability used by the attacker. Without rigorous verification in this phase, the enterprise remains vulnerable to reinfection, as attackers often leave dormant persistence mechanisms that can be triggered if the remediation is not thorough.

Answer

Identification

Answer

Containment

Answer

Lessons Learned

Question 20

An organization detects a sophisticated adversary attempting to move laterally using Pass-the-Hash (PtH) techniques. Which THREE of the following configurations or practices are most effective at mitigating this risk?

Accepted Answer

Enable Credential Guard on all workstations and servers.. Pass-the-Hash exploits the way NTLM stores password hashes in memory. By limiting the scope of where privileged accounts can authenticate and restricting the use of legacy protocols like NTLM in favor of Kerberos, organizations can significantly shrink the attack surface. Implementing Credential Guard provides an additional layer of hardware-based isolation that prevents the extraction of these hashes from memory, effectively neutralising the primary mechanism that attackers rely on for lateral movement within a domain.

Answer

Increase the minimum password length requirement to 20 characters.

Answer

Regularly scan for and remove all local user accounts.