GCFA Enterprise Environment Incident Response Practice Test 2 — 15 Questions

Question 1

An enterprise incident response team is preparing to acquire volatile evidence from a compromised Windows server. The server is running critical business applications, and management wants to minimize downtime. Which TWO of the following actions should the team perform to properly capture volatile data while preserving system integrity? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run 'netstat -anob' to record active network connections and associated process IDs.. Capturing physical memory preserves the most volatile evidence, including running processes and network connections. Recording network connections with netstat provides a live snapshot of command-and-control activity. Both actions are non-destructive and do not require downtime, making them appropriate for live response on a critical server. Shutting down, disconnecting, or running antivirus would either destroy evidence or disrupt operations.

Answer

Immediately shut down the server to prevent further attacker actions.

Answer

Disconnect the server from the network to isolate it.

Answer

Run a full antivirus scan to remove any malware.

Question 2

An incident responder is analyzing a memory dump from a compromised Windows 10 workstation. The attacker used a fileless malware technique that injected malicious code into a legitimate process. The responder needs to identify the injected code and the process it is running in. Which of the following memory forensics techniques is MOST appropriate for this task?

Accepted Answer

Analyzing process hollowing by comparing disk and memory images. Process hollowing involves replacing the memory of a legitimate process with malicious code. Comparing the in-memory image of a process with its corresponding executable on disk reveals discrepancies, such as missing sections or altered code. This technique directly identifies the hollowed process and the injected payload, making it the most appropriate for this scenario.

Answer

Scanning for known malicious strings

Answer

Examining the Master File Table (MFT) for alternate data streams

Answer

Checking the Windows event logs for process creation events

Question 3

During a post-incident review, a team realizes they missed a critical indicator of compromise (IOC) because they did not normalize their log data. What is the primary benefit of log normalization in an enterprise incident response environment?

Accepted Answer

It enables cross-platform correlation by providing a consistent event schema.. Log normalization transforms heterogeneous data from various vendors, formats, and sources into a standardized schema. This allows security tools to correlate events across the environment, such as matching a Windows Security log event to a Cisco firewall connection. Without normalization, analysts spend significant time manually parsing logs, which delays detection and increases the likelihood of missing subtle, multi-stage attack patterns that occur across disparate systems during an enterprise-wide security breach.

Answer

It removes sensitive PII from logs to ensure regulatory compliance.

Answer

It compresses log files, reducing storage costs for long-term retention.

Answer

It automatically blocks malicious traffic detected within the log streams.

Question 4

Which phase of the incident response lifecycle is most directly responsible for ensuring that an enterprise environment is returned to a secure, verified state after an intrusion?

Accepted Answer

Recovery. The recovery phase is where the focus shifts from stopping the bleeding to restoring business operations securely. This involves verifying that all backdoors have been closed, credentials have been rotated, and systems are patched against the initial vulnerability used by the attacker. Without rigorous verification in this phase, the enterprise remains vulnerable to reinfection, as attackers often leave dormant persistence mechanisms that can be triggered if the remediation is not thorough.

Answer

Identification

Answer

Containment

Answer

Lessons Learned

Question 5

An organization detects a sophisticated adversary attempting to move laterally using Pass-the-Hash (PtH) techniques. Which THREE of the following configurations or practices are most effective at mitigating this risk?

Accepted Answer

Enable Credential Guard on all workstations and servers.. Pass-the-Hash exploits the way NTLM stores password hashes in memory. By limiting the scope of where privileged accounts can authenticate and restricting the use of legacy protocols like NTLM in favor of Kerberos, organizations can significantly shrink the attack surface. Implementing Credential Guard provides an additional layer of hardware-based isolation that prevents the extraction of these hashes from memory, effectively neutralising the primary mechanism that attackers rely on for lateral movement within a domain.

Answer

Increase the minimum password length requirement to 20 characters.

Answer

Regularly scan for and remove all local user accounts.

Question 6

An incident responder is reviewing EDR alerts and discovers an 'Account Manipulation' event. What is the most common reason why an attacker would target the 'Domain Admins' group during the post-exploitation phase?

Accepted Answer

To gain unrestricted control over the entire domain and its resources.. Targeting the Domain Admins group is the 'holy grail' for an attacker because it provides full control over the entire Active Directory domain. With these privileges, an attacker can disable security controls, create new accounts, exfiltrate sensitive data, and install persistent backdoors across all systems joined to the domain. This level of access effectively grants the attacker the ability to operate undetected and exert complete influence over the organization's enterprise infrastructure.

Answer

To bypass the need for multi-factor authentication on local machines.

Answer

To encrypt the Active Directory database for ransomware demands.

Answer

To hide their tracks by clearing the Windows Event logs globally.

Question 7

Which of the following describes the 'Principle of Least Privilege' applied to incident response accounts?

Accepted Answer

Limiting IR account access to only the specific data and systems needed for the investigation.. Using dedicated, limited-scope accounts for incident response ensures that if the responder's account is compromised, the attacker does not gain enterprise-wide administrative access. By providing only the permissions necessary for the investigation—such as read-only access to logs or forensic imaging permissions—the risk of accidental or malicious damage to the production environment is minimized, ensuring that the integrity of the IR process remains intact even in a hostile or complex environment.

Answer

Using a Domain Admin account for all investigation tasks to avoid access issues.

Answer

Granting forensic responders full system access to all network segments.

Answer

Ensuring all IR accounts have a shared password for rapid response coordination.

Question 8

An organization discovers that an attacker is using 'Living off the Land' (LotL) binaries to execute malicious code. Why are LotL attacks particularly difficult to detect in an enterprise environment?

Accepted Answer

They utilize trusted system processes that are frequently used by administrators.. LotL attacks utilize legitimate, pre-installed system tools like PowerShell, WMI, or Certutil to execute malicious payloads. Because these tools are trusted and frequently used for legitimate administrative tasks, they often bypass traditional signature-based antivirus or allowlisting solutions. Detecting these requires sophisticated behavioral analysis, such as looking for anomalous command-line flags, unusual process ancestry, or unexpected execution patterns, which are significantly harder to differentiate from routine administrative activity compared to detecting known malicious malware binaries.

Answer

The tools are specifically designed by attackers to bypass security.

Answer

They operate entirely in memory and leave no file system artifacts.

Answer

The attacker encrypts the binaries so antivirus cannot scan them.

Question 9

When investigating a suspected data exfiltration incident, which TWO sources are most useful for determining the volume and destination of the transferred data?

Accepted Answer

Network flow (NetFlow) logs.. Firewall logs and NetFlow data are the most reliable sources for quantifying data exfiltration. Firewall logs provide information about the connections made, while NetFlow provides the volume of data transferred between specific source and destination IPs. By analyzing these, an analyst can pinpoint the exact amount of data that left the network and where it was sent, which is crucial for reporting the incident's impact and determining the nature of the breached data.

Answer

Application performance monitoring (APM) logs.

Answer

Endpoint antivirus event logs.

Answer

Active Directory authentication logs.

Question 10

An organization is deploying an EDR solution to improve incident response capabilities. What is the most critical factor to consider when configuring EDR policies for a production environment?

Accepted Answer

Balancing security posture with the risk of operational impact.. EDR policies must be carefully tuned to prevent false positives that can lead to system instability, such as inadvertently blocking critical business processes or causing performance degradation. In production, an 'alert-only' mode is often implemented first to gather data and validate the impact. Without proper testing and tuning, a overly aggressive EDR configuration can disrupt legitimate operations, causing more damage to business productivity than the threats the EDR is intended to mitigate.

Answer

Ensuring the EDR agent is configured to delete all suspicious files automatically.

Answer

Forcing all EDR logs to be stored in the cloud for infinite retention.

Answer

Disabling all other security tools to prevent agent conflict.

Question 11

Why is it important to include non-security personnel, such as legal counsel and HR, in the incident response process for a significant data breach?

Accepted Answer

They provide necessary oversight to ensure the company remains compliant with regulations.. Large-scale data breaches have profound legal and regulatory implications that go far beyond technical remediation. Legal counsel ensures the organization meets mandatory disclosure timelines and manages liability, while HR manages the human element, especially if the breach involved insider threats or required employee-related actions. Their involvement ensures the organization stays compliant with the law and minimizes organizational risk, which is just as vital as the technical work of stopping the attacker.

Answer

They provide technical expertise needed to reverse engineer the malware.

Answer

They are required to manually approve all firewall changes in the network.

Answer

They are responsible for conducting the forensic investigation of the servers.

Question 12

An organization is deploying an EDR solution across a hybrid environment. Which TWO of the following tasks are critical for ensuring effective incident response visibility?

Accepted Answer

Configuring full-stack telemetry collection across all managed endpoints.. Successful EDR deployment requires both technical configuration and operational integration. Ensuring comprehensive coverage across all endpoints prevents blind spots where attackers can hide, while defining automated response playbooks allows the IR team to scale their efforts during high-velocity incidents. These tasks are foundational to reducing mean time to respond, as they ensure high-fidelity telemetry is available and actionable, allowing for rapid containment of threats before they escalate across the enterprise network.

Answer

Excluding all antivirus-flagged files from the EDR scanning scope.

Answer

Disabling kernel-mode auditing to improve endpoint performance metrics.

Answer

Restricting data retention to 24 hours to comply with privacy regulations.

Question 13

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Accepted Answer

The process with PID 4820.. The exhibit shows two active connections. The first is a standard SMB connection, but the second, PID 4820, connects to an external IP on port 443. This is highly suspicious for a server that should not have direct outbound HTTPS communication to an unknown external host. Identifying the process associated with PID 4820 allows the analyst to trace the activity back to the binary responsible for the unauthorized external communication, which is a key indicator of C2 traffic.

Answer

The process with PID 4.

Answer

The connection to 10.10.1.5.

Answer

The SMB connection on port 445.

Question 14

During a cloud-based incident, you determine that an attacker has gained access to an IAM role with excessive permissions. What is the most effective containment step to minimize the blast radius without causing immediate service outages?

Accepted Answer

Attach an inline policy to deny all actions for the compromised role.. In cloud environments, the most precise way to contain an identity-based attack is to apply an inline policy to the compromised role that explicitly denies all actions, or to revoke the active session tokens. By narrowing the scope of permissions or invalidating current credentials, responders can prevent the attacker from performing further unauthorized API calls while allowing legitimate, non-impacted services to continue functioning correctly within the environment.

Answer

Delete the IAM role immediately.

Answer

Change the password for the root user account.

Answer

Disable the entire cloud subscription or account.

Question 15

Refer to the exhibit. An attacker attempts to use a compromised identity with this policy to modify a file in the 'sensitive-data' bucket. What is the expected outcome?

Accepted Answer

The request is denied by the service.. The IAM policy explicitly grants the 's3:GetObject' permission, which allows reading files but not modifying them. Because IAM policies follow the principle of least privilege and default to deny, any action not explicitly granted—such as 's3:PutObject' or 's3:DeleteObject'—will be denied. This is crucial for responders to understand, as it confirms that the attacker's write-based actions were blocked, potentially limiting the impact to data exfiltration rather than data tampering.

Answer

The request is successful due to default wide permissions.

Answer

The request is successful because the resource is a bucket wildcard.

Answer

The request is denied only if MFA is enabled.