GCFA Enterprise Environment Incident Response Practice Test 4 — 15 Questions

Question 1

A large enterprise is responding to a ransomware incident. The adversary has deployed malware that encrypts files and deletes volume shadow copies. The incident response team needs to determine the initial infection vector and the scope of the compromise. They have collected logs from various sources. Which of the following log sources is MOST likely to contain evidence of the initial infection vector if the adversary used a phishing email with a malicious attachment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Email gateway logs. Email gateway logs are specifically designed to record email metadata and content, including attachments. In a phishing incident, these logs provide the earliest evidence of the attack, showing the malicious email's delivery, sender, and attachment details. This allows responders to identify the initial vector, block similar emails, and notify other potential victims. Other log sources may show subsequent activity but lack the email context.

Answer

Windows Security event logs on the domain controller

Answer

Sysmon logs on user workstations

Answer

Firewall logs

Question 2

During an enterprise incident, you discover that an attacker modified the Windows event log service to record only selected events, effectively hiding malicious activity. Which Windows artifact should you analyze first to determine what modifications were made to the logging configuration?

Accepted Answer

The SYSTEM registry hive, specifically the EventLog service key.. The EventLog service configuration is stored in the SYSTEM registry hive, making it the definitive source for determining if an attacker altered logging settings. Other artifacts like event logs themselves or file system metadata may provide indirect clues, but they do not contain the configuration details needed to identify what was changed. Examining the SYSTEM hive allows responders to see exactly which logs were enabled or disabled.

Answer

The NTFS $LogFile for the volume containing the event logs.

Answer

The Application event log for service control manager events.

Answer

The Security event log (EVTX) for event ID 1102.

Question 3

During an enterprise incident response involving a compromised Windows server, you need to acquire volatile evidence in a forensically sound manner. Which TWO of the following actions should be performed first to preserve the most volatile data? (Choose two.)

Accepted Answer

Capture the contents of physical memory (RAM) using a tool like WinPmem or DumpIt.. The order of volatility dictates that physical memory and active network connections are the most perishable. Capturing RAM preserves running processes and encryption keys, while recording network connections captures transient command-and-control activity. These two actions must be performed first to prevent loss of critical evidence before moving to less volatile sources like disk images or event logs.

Answer

Export the Windows Event Logs to a secure location.

Answer

Take screenshots of the desktop and open applications.

Answer

Create a forensic image of the system drive using FTK Imager or dd.

Question 4

An incident responder is reviewing logs from a compromised Linux server and notices a large number of failed SSH login attempts from a single external IP address, followed by a successful login. Which of the following best describes this activity?

Accepted Answer

A brute-force attack that resulted in unauthorized access.. The sequence of numerous failed SSH logins from a single external IP followed by a successful login is a classic indicator of a brute-force attack that succeeded. This constitutes unauthorized access and requires immediate incident response actions, including isolating the server, investigating the attacker's activities, and resetting compromised credentials.

Answer

A misconfigured SSH client repeatedly attempting to authenticate with an expired key.

Answer

A denial-of-service attack that overwhelmed the SSH service.

Answer

A legitimate user who forgot their password and eventually guessed it correctly.

Question 5

An incident responder is investigating a compromised Windows server. The attacker gained access via a Remote Desktop Protocol (RDP) brute-force attack and then created a new local user account for persistence. The responder needs to identify evidence of the newly created account and any subsequent logon activity. Which TWO of the following Windows artifacts should the responder examine to find this evidence? (Choose two.)

Accepted Answer

SAM registry hive. The Security event log records account creation (4720) and logon events (4624), providing a timeline of the attacker's actions. The SAM registry hive stores the local account database, including the new account's details, and can be analyzed even if logs are cleared. Together, they offer direct evidence of the new account and its use, which is critical for understanding the persistence mechanism.

Answer

Application event log (Event ID 1000)

Answer

System event log (Event ID 7045)

Answer

Prefetch files

Question 6

An incident responder is preparing to acquire a forensic image of a running Windows server that is suspected of being compromised. The server hosts a critical database that cannot be taken offline. Which method is most appropriate for acquiring the disk image while minimizing disruption?

Accepted Answer

Use a live acquisition tool like FTK Imager or Magnet ACQUIRE to create a forensic image of the disk while the system is running.. For a running server that cannot be taken offline, live acquisition with a tool like FTK Imager or Magnet ACQUIRE is the best option. These tools create a forensic image of the disk while the system is operational, preserving the data with minimal disruption. However, they should be used in conjunction with volatile data collection to capture memory and network state.

Answer

Use a hardware write blocker and remove the disk to image it on a separate workstation.

Answer

Run the built-in Windows backup utility to create a system image to a network share.

Answer

Use diskpart to create a shadow copy and then copy the volume to an external drive.

Question 7

During an enterprise incident response, you are examining evidence on a Windows Server 2019 system that may contain a fileless malware infection. You need to determine whether a specific process was injected with malicious code. Which Windows forensic artifact is most directly useful for identifying anomalous memory regions in a process, such as those created by reflective DLL injection?

Accepted Answer

Memory dump of the process. Reflective DLL injection loads a DLL directly into memory without writing it to disk, so disk-based artifacts like Prefetch or MFT entries will not show the injected code. A process memory dump captures the actual memory contents, allowing the analyst to spot anomalous regions such as executable memory not backed by a file. This makes the memory dump the most direct and reliable artifact for this scenario.

Answer

MFT (Master File Table) entries

Answer

Prefetch files

Answer

Windows Event Log Security log

Question 8

An incident responder is investigating a compromised Windows system and finds that the attacker used a technique known as 'process hollowing' to hide malicious code. Which of the following best describes how process hollowing works?

Accepted Answer

The attacker creates a new process in a suspended state, replaces its memory with malicious code, and then resumes the process.. Process hollowing is a technique where an attacker creates a legitimate process in a suspended state, replaces its memory with malicious code, and then resumes it. This allows the malicious code to run under the guise of a trusted process, making it harder to detect. Memory forensics can reveal inconsistencies between the on-disk executable and the in-memory image.

Answer

The attacker injects malicious code into a running process by using remote thread creation, without replacing the entire process image.

Answer

The attacker exploits a vulnerability in a legitimate process to execute arbitrary code within its context, without modifying its memory.

Answer

The attacker uses a scheduled task to execute a malicious script that masquerades as a legitimate system process.

Question 9

An enterprise incident responder is analyzing a compromised Windows 10 workstation. The attacker used a scheduled task to maintain persistence. The responder runs 'schtasks /query /fo LIST /v' and sees a task named 'Updater' with the action 'C:\Windows\Temp\svchost.exe'. However, the file svchost.exe is not present in that directory. Which of the following best explains why the task still appears and what should the responder do next?

Accepted Answer

The file may have been deleted by the attacker or antivirus; the task definition remains in the registry and should be examined and removed if malicious.. Scheduled tasks persist in the registry and on disk even if the referenced executable is missing. The attacker may have deleted the executable to hinder analysis, but the task definition remains and can be used to re-establish persistence if the file is restored. The responder must examine the task's XML, registry entries, and creation time, then remove it if malicious. This ensures the persistence mechanism is fully eradicated.

Answer

The task is likely a legitimate Windows component; svchost.exe in Temp is normal. The responder should ignore it.

Answer

The task is a ghost entry; it will be removed after a reboot. No further action is needed.

Answer

The task was created by a Group Policy Object (GPO); it will be recreated on next policy refresh. The responder should check GPOs.

Question 10

An incident responder is analyzing a compromised Windows 10 workstation in an enterprise environment. The adversary used a known malware family that injects code into a legitimate process and then clears the associated event log entries to hinder detection. The responder has a memory image captured from the live system and a disk image acquired afterward. Which artifact in the memory image is most likely to reveal the injected code region and its originating module, even if the on-disk executable was deleted?

Accepted Answer

The process's virtual address descriptor (VAD) tree and associated memory sections. The VAD tree is the memory structure that tracks every mapped region in a process, including private executable pages typical of code injection. Because injected code is often not backed by a file on disk, the VAD metadata is the most direct way to identify the anomalous region. Other artifacts like MFT records, Prefetch, or event logs may provide context but do not contain the injected code or its originating module.

Answer

The Security event log records in the memory image

Answer

The Windows Prefetch file for the injected process

Answer

The MFT record for the deleted executable

Question 11

An enterprise incident responder is analyzing a compromised Linux server. The attacker used a rootkit that hooks system calls to hide processes and files. Which forensic technique is most effective to detect the rootkit's presence and identify hidden processes?

Accepted Answer

Compare the output of ps and /proc directory listings.. A system call hooking rootkit often intercepts system calls used by tools like ps, causing them to omit hidden processes. The /proc file system, however, is generated by the kernel and may still list all processes. By comparing the process list from ps with the directory entries in /proc, an investigator can identify processes that are present in /proc but missing from ps, indicating rootkit manipulation. This technique is a classic method for detecting user-mode rootkits.

Answer

Run chkrootkit and rkhunter to scan for known rootkit signatures.

Answer

Inspect the output of netstat -tulpn for unusual listening ports.

Answer

Use Volatility to analyze a memory dump for hidden processes.

Question 12

An enterprise incident response team is preparing to contain a confirmed ransomware outbreak that has already encrypted several file servers. The team must preserve forensic evidence while stopping further spread. Which two actions best balance evidence preservation with containment in this scenario? (Choose two.)

Accepted Answer

Isolate affected servers from the network at the switch or EDR level while keeping them powered on. Isolating affected servers at the network layer stops the spread without destroying volatile evidence, and capturing memory before containment preserves fragile artifacts such as encryption keys and active processes. Together they satisfy containment and preservation. Powering off, reimaging, or deleting files would destroy evidence or recovery options and do not represent a balanced response.

Answer

Reimage all affected servers immediately to restore business operations

Answer

Immediately power off all affected servers to halt encryption activity

Answer

Delete all encrypted files to prevent the ransomware from spreading further

Question 13

An organization is responding to a ransomware incident. The attackers encrypted files on several servers and left a ransom note. Which immediate action should the incident response team take to preserve the most volatile evidence before shutting down the affected systems?

Accepted Answer

Collect volatile data such as memory and network connections.. The order of volatility dictates that the most volatile evidence, such as memory and network connections, should be collected first. In a ransomware incident, memory can contain encryption keys and indicators of compromise that are crucial for response and recovery. Disk imaging and containment actions can be performed afterward without losing this critical data. Interviews are non-technical and can be done at any time.

Answer

Interview system administrators about the ransomware note.

Answer

Disconnect the servers from the network to prevent further spread.

Answer

Capture a forensic image of the disk drives.

Question 14

An enterprise incident response team is handling a breach where the adversary used valid credentials to access a cloud-hosted email service and created a mailbox forwarding rule to exfiltrate messages. The team has identified the compromised account and wants to determine the full scope of mailbox access and rule creation across the tenant. Which single action should the responder take to obtain the authoritative audit record of these activities?

Accepted Answer

Export the Unified Audit Log from the Microsoft 365 compliance center and filter for mailbox rule and access events. The Unified Audit Log is the authoritative tenant-wide record for mailbox access and rule creation in Microsoft 365. It captures events like New-InboxRule and MailItemsAccessed, allowing the responder to determine the full scope of adversary activity. Message trace, client logs, and Microsoft Entra ID sign-in logs provide complementary but incomplete views and do not record the mailbox-level actions needed.

Answer

Run a message trace in the Exchange admin center for the past 30 days

Answer

Inspect the Azure AD sign-in logs for the compromised account

Answer

Review the mailbox owner's Outlook client logs on their workstation

Question 15

An incident responder is analyzing a Linux server that was compromised. The attacker gained initial access via SSH and then created a new user account named 'support' with UID 0. Which command should the responder use to quickly identify all accounts with UID 0 on the system?

Accepted Answer

cat /etc/passwd | grep ':0:'. The /etc/passwd file stores user account details, including the UID in the third field. Searching for ':0:' isolates accounts with UID 0, which have root privileges. This quickly uncovers any unauthorized root-equivalent accounts created by an attacker. Other commands like ls, ps, or netstat do not provide UID information and would not detect the malicious account.

Answer

netstat -tulpn

Answer

ps aux | grep root

Answer

ls -la /home