GCFA Hard Questions — 25 Difficult Questions

Question 1

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.. Sysmon ProcessAccess events targeting lsass.exe with access masks like 0x1010 or 0x1410 directly show attempts to read LSASS memory, which is central to credential dumping. Similarly, an lsass.dmp file created in a user-writable directory with a corresponding file creation event provides concrete evidence of memory dumping. Both artifacts are high-fidelity indicators of credential theft.

Answer

Windows Security event ID 4672 indicating special privileges assigned to a new logon for a service account.

Answer

Windows Security event ID 4688 with process creation for a known credential dumping tool, including its command line.

Answer

Windows Security event ID 4624 logon type 3 (network) from a workstation to the domain controller.

Question 2

Which THREE items are critical to inspect when analyzing a memory dump for evidence of Process Hollowing or Injection?

Accepted Answer

Memory Page Permissions (RWX). Process injection techniques often modify memory protections or inject code into existing legitimate processes. By comparing the disk-based image of a process with its memory-based representation, analysts can identify discrepancies in executable sections. Checking memory protections (e.g., RWX permissions) and identifying unbacked executable code in private memory regions are the primary methods for uncovering sophisticated persistent threats that operate entirely within the volatile memory space.

Answer

The system's Event Log files

Answer

The MFT file records

Question 3

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 4

An incident responder is analyzing a memory image from a Windows 10 system that is suspected of being infected with a fileless malware. The responder runs the Volatility 3 windows.malfind plugin and observes several memory regions with PAGE_EXECUTE_READWRITE protection and a MZ header. However, the responder notices that some of these regions are backed by a file on disk, while others are not. Which of the following conclusions is most appropriate regarding the unbacked regions?

Accepted Answer

The unbacked regions are indicative of injected code or shellcode, as they do not correspond to any file on disk and have suspicious permissions.. In memory forensics, unbacked memory regions with PAGE_EXECUTE_READWRITE protection and executable content such as an MZ header strongly suggest injected code or shellcode. Legitimate code is typically backed by a file on disk via a mapped section. The lack of file backing means the code was likely written directly into the process's address space by an injection technique, a common characteristic of fileless malware. This finding should prompt further extraction and analysis of the injected payload.

Answer

The unbacked regions are likely legitimate DLLs loaded from disk but with modified permissions due to process hardening.

Answer

The unbacked regions are artifacts of the Volatility plugin itself, which may incorrectly report memory as unbacked due to parsing errors.

Answer

The unbacked regions are likely due to memory compression or paging, where the file backing was temporarily removed from the working set.

Question 5

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable. The analyst wants to determine whether the executable was actually executed on the system. Which additional artifact should the analyst examine to confirm execution?

Accepted Answer

Prefetch files. Prefetch files are created by the Windows Cache Manager when an executable is run, recording the execution time and run count. This directly confirms execution. ShimCache only shows that a file was present and may have been executed, so Prefetch is the best additional artifact to verify execution. Amcache, UserAssist, and SRUM may provide supporting evidence but are not as definitive or comprehensive for this purpose.

Answer

SRUM (System Resource Usage Monitor)

Answer

Amcache.hve

Answer

UserAssist

Question 6

A forensic analyst is examining a memory dump from a Windows 10 system that is suspected of being infected with a rootkit that hides its presence by unlinking its process from the active process list. The analyst runs Volatility 3 and compares the output of the windows.pslist and windows.psscan plugins. Which of the following best describes the expected discrepancy between these two plugins in the presence of such a rootkit?

Accepted Answer

windows.psscan will show more processes than windows.pslist because it can detect processes that have been unlinked from the active process list.. windows.pslist enumerates processes by following the active process list, which a rootkit can manipulate by unlinking its process. windows.psscan, however, scans memory for process objects using pool tags, which does not rely on the list. Therefore, in the presence of a process-unlinking rootkit, windows.psscan will detect the hidden process, resulting in a higher process count compared to windows.pslist. This discrepancy is a key indicator of hidden processes.

Answer

windows.pslist will show more processes than windows.psscan because it includes terminated processes that are still in memory.

Answer

Both plugins will show the same number of processes because they both use the same underlying data structure.

Answer

windows.psscan will show fewer processes than windows.pslist because it relies on a linked list that the rootkit modifies.

Question 7

An analyst is examining a memory image from a Windows 10 system that is suspected of being infected with malware that uses process hollowing. The analyst wants to identify processes that may have been hollowed. Which TWO of the following artifacts or techniques are most indicative of process hollowing? (Choose two.)

Accepted Answer

The process's image path in memory does not match the file path on disk.. Process hollowing involves creating a legitimate process in a suspended state, unmapping its memory, and injecting malicious code. This results in two key indicators: the in-memory image path may not match the disk file (or the memory content differs from disk), and threads execute from memory regions not backed by a file. These artifacts are directly tied to the hollowing technique and are detectable through memory analysis.

Answer

The process's token indicates it is running with elevated privileges.

Answer

The process's parent process ID (PPID) is a non-existent process.

Answer

The process has a large number of open handles to remote named pipes.

Question 8

When identifying a hidden process via a cross-view analysis, which memory structure is most reliable to compare against the EPROCESS list?

Accepted Answer

The thread list in the scheduler. Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Answer

The Master File Table (MFT)

Answer

The user-mode Process Environment Block (PEB)

Answer

The System Service Descriptor Table (SSDT)

Question 9

An investigator is analyzing a Windows system and notices that a file's $STANDARD_INFORMATION timestamps show a creation date of 2020, while the $FILE_NAME timestamps show a creation date of 2023. The file's content appears to be from 2023. The investigator suspects timestomping. Which NTFS artifact should be examined to corroborate the true creation time by looking at when the file's MFT record was last modified?

Accepted Answer

The $LogFile transaction records for the MFT record. The $LogFile is a transactional log that records metadata changes to NTFS structures, including MFT record updates. If timestomping altered $STANDARD_INFORMATION timestamps, the $LogFile may still contain records showing when the MFT record was actually modified. This can corroborate the true creation time. The other options are either part of the manipulable $STANDARD_INFORMATION or do not directly record MFT record modification.

Answer

The $MFT record's $STANDARD_INFORMATION attribute change time

Answer

The $MFT record's $STANDARD_INFORMATION MFT entry modified time

Answer

The $FILE_NAME attribute's creation timestamp

Question 10

Which TWO of the following are considered reliable methods for detecting hidden processes in memory forensics?

Accepted Answer

psscan pool tag analysis. Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

Answer

pslist enumeration

Answer

Task Manager API polling

Answer

Registry hive parsing

Question 11

An incident responder is building a MACB timeline from an ext4 file system using the Sleuth Kit. Why might the resulting timeline display execution timestamps or access times that appear unreliable for establishing user activity?

Accepted Answer

Mount options such as relatime or noatime suppress continuous updates to file access timestamps to improve performance.. The ext4 file system supports the noatime mount option, which disables the updating of access times whenever files are read. This optimization significantly reduces disk I/O overhead but blinds investigators to critical file access timelines, making it difficult to prove whether a specific binary was actually executed by a local user.

Answer

The ext4 journal aggressively overwrites inode metadata before user-space tools can parse the raw blocks.

Answer

The operating system automatically randomizes inode timestamps every 24 hours to prevent precise profiling.

Answer

The Sleuth Kit parser inherently misinterprets the 64-bit epoch time structures utilized by modern Linux kernels.

Question 12

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Accepted Answer

The process has been infected via code injection. The presence of the 'MZ' header (the magic bytes for a Windows PE executable) in a memory region that is not backed by a file on disk (VadS) and is marked as PAGE_EXECUTE_READWRITE is definitive proof of an injected executable. The malware has loaded a complete, valid PE file directly into memory to run its payload, which is a classic indicator of advanced fileless malware that bypasses file-system-based security controls.

Answer

The process is running a standard, signed driver

Answer

The process is using a standard heap allocation

Answer

The memory segment is a legitimate shared DLL

Question 13

An incident responder is analyzing a compromised Windows 10 workstation in an enterprise environment. The adversary used a known malware family that injects code into a legitimate process and then clears the associated event log entries to hinder detection. The responder has a memory image captured from the live system and a disk image acquired afterward. Which artifact in the memory image is most likely to reveal the injected code region and its originating module, even if the on-disk executable was deleted?

Accepted Answer

The process's virtual address descriptor (VAD) tree and associated memory sections. The VAD tree is the memory structure that tracks every mapped region in a process, including private executable pages typical of code injection. Because injected code is often not backed by a file on disk, the VAD metadata is the most direct way to identify the anomalous region. Other artifacts like MFT records, Prefetch, or event logs may provide context but do not contain the injected code or its originating module.

Answer

The Security event log records in the memory image

Answer

The Windows Prefetch file for the injected process

Answer

The MFT record for the deleted executable

Question 14

Why does the use of 'DKOM' (Direct Kernel Object Manipulation) by rootkits pose a significant challenge for traditional forensic tools that rely on the Windows API?

Accepted Answer

It hides the process by unlinking it from the process list. Traditional tools rely on the Windows API to list processes and threads. These APIs query the kernel's process list (ActiveProcessLinks). DKOM allows a rootkit to unlink a process from this list while leaving the process structure intact so it can still be scheduled for execution. Because the API only reports what the kernel's linked list reveals, the hidden process effectively disappears from standard tools, requiring forensic analysts to use memory-parsing techniques.

Answer

It encrypts the entire memory dump

Answer

It prevents the acquisition of the memory dump

Answer

It modifies the CPU instructions directly

Question 15

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Accepted Answer

Sysmon Event ID 3 (NetworkConnect) entries showing repeated connections to the same external IP at regular intervals.. Beaconing is characterized by repeated, regular communication from a host to an external controller. Sysmon network-connect events and DNS query events both capture the timing, destination, and initiating process needed to confirm that pattern directly from the endpoint. Logon, application-crash, and service-install events may support the broader investigation but do not, by themselves, demonstrate periodic outbound C2 traffic.

Answer

Application Event ID 1000 (Application Error) entries referencing a crashing service.

Answer

System Event ID 7045 (A service was installed in the system) recorded once during the investigation window.

Answer

Security Event ID 4624 (An account was successfully logged on) with Logon Type 3 repeated every few minutes.

Question 16

You are analyzing a system and find evidence that a user has executed a PowerShell script that imports the 'Net.WebClient' class. What is the most likely purpose of this script?

Accepted Answer

To download and execute a remote payload from a C2 server.. The 'Net.WebClient' class in .NET is frequently used in PowerShell to download remote content. In a forensic context, it is a hallmark of download-and-execute malware. Attackers use this to fetch secondary payloads from C2 servers. Identifying this class usage is critical for characterizing the scope of an attack, as it explains how the initial stub on the system was used to pull down more complex malicious tools.

Answer

To perform local file system encryption for data backup.

Answer

To monitor the system for unauthorized network connections.

Answer

To clear the Windows Event Logs to hide tracks.

Question 17

During a memory forensics investigation of a Windows 10 image, you suspect an attacker injected code into a legitimate process. Which TWO Volatility 3 plugins would you use together to detect and characterize the injected code? (Choose two.)

Accepted Answer

windows.vadinfo. windows.malfind finds executable memory regions not backed by a file, which is the signature of injected code, while windows.vadinfo provides the virtual address descriptor details for those regions, including protection and commit type. Using them together lets the analyst detect the injection and then characterize it as private, executable, and fileless within the target process.

Answer

windows.netscan

Answer

windows.handles

Answer

windows.registry.hivelist

Question 18

Which TWO of the following attributes in an NTFS MFT record are most critical for establishing the 'MACB' timeline of a file?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME. The $STANDARD_INFORMATION ($SI) and $FILE_NAME ($FN) attributes both contain timestamps. $SI is what standard Windows APIs report to the user, while $FN is updated only by the system kernel during specific file operations. Comparing these two enables detection of 'timestomping' attacks where a user modifies $SI times to hide malicious activity, making them essential for high-fidelity forensic analysis.

Answer

$DATA and $ATTRIBUTE_LIST

Answer

$STANDARD_INFORMATION and $DATA

Answer

$FILE_NAME and $INDEX_ROOT

Answer

$LOGGED_UTILITY_STREAM and $STANDARD_INFORMATION

Question 19

An analyst is examining an NTFS volume and finds that a file's $DATA attribute is resident. The file size is 800 bytes. The analyst attempts to recover the file content using a tool that only reads the data runs from the MFT record. What will be the outcome of this recovery attempt?

Accepted Answer

The tool will fail to recover the file content because it does not parse the resident data within the MFT record.. Resident $DATA attributes store file content directly within the MFT record, not in separate clusters. A tool that only reads data runs is designed for non-resident attributes and will not extract resident data. Therefore, the recovery attempt will fail because the tool does not parse the resident data. The content remains in the MFT record but is inaccessible to this tool.

Answer

The tool will recover only the first 800 bytes from the data runs, which are partially resident.

Answer

The tool will successfully recover the file content because the data is stored in the MFT record.

Answer

The tool will recover the file content from the $ATTRIBUTE_LIST if the resident data overflows the MFT record.

Question 20

A large enterprise is responding to a ransomware incident. The adversary has deployed malware that encrypts files and deletes volume shadow copies. The incident response team needs to determine the initial infection vector and the scope of the compromise. They have collected logs from various sources. Which of the following log sources is MOST likely to contain evidence of the initial infection vector if the adversary used a phishing email with a malicious attachment?

Accepted Answer

Email gateway logs. Email gateway logs are specifically designed to record email metadata and content, including attachments. In a phishing incident, these logs provide the earliest evidence of the attack, showing the malicious email's delivery, sender, and attachment details. This allows responders to identify the initial vector, block similar emails, and notify other potential victims. Other log sources may show subsequent activity but lack the email context.

Answer

Windows Security event logs on the domain controller

Answer

Sysmon logs on user workstations

Answer

Firewall logs