GCFA Identification of Malicious and Normal Activity Practice Test 1 — 15 Questions

Question 1

Which TWO of the following indicators are highly suggestive of credential dumping activity in memory?

Accepted Answer

A user-mode process requesting PROCESS_VM_READ access to lsass.exe.. Credential dumping tools often interact with the Local Security Authority Subsystem Service (LSASS) to extract hashes or plain-text passwords. Observing process access requests to LSASS by non-system processes is a primary indicator. Furthermore, the presence of specific temporary files or unusual command-line arguments used by known post-exploitation frameworks provides high-confidence signatures that security analysts can use to confirm an active credential theft attempt during an investigation.

Answer

lsass.exe process opening a handle to a browser process.

Answer

A non-system process requesting PROCESS_QUERY_LIMITED_INFORMATION on lsass.exe.

Answer

Increase in network traffic volume on port 53.

Question 2

Refer to the exhibit. What type of attack is demonstrated in this server response?

Accepted Answer

Cross-Site Scripting (XSS).. The injected script attempts to capture the user's session cookie and exfiltrate it to an external domain. This is a hallmark of a Cross-Site Scripting (XSS) attack. By embedding malicious JavaScript into the HTML response, the attacker can execute code within the context of the user's browser, potentially stealing session identifiers or performing actions on behalf of the authenticated user to compromise their account access.

Answer

SQL Injection.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Buffer Overflow.

Question 3

Which artifact is most useful for detecting unauthorized persistence via a Windows registry Run key?

Accepted Answer

Sysmon Event ID 12 or 13.. The registry contains several 'Run' and 'RunOnce' keys that launch applications upon user or system startup. Malicious actors frequently modify these keys to ensure their malware survives a reboot. Auditing registry changes (via System Monitor/Sysmon) or examining the registry hive files offline during forensics provides the visibility needed to identify hidden persistence mechanisms that are not easily visible through standard process list reviews.

Answer

Windows Event ID 4688.

Answer

The browser cache folder contents.

Answer

Network flow logs from the border firewall.

Question 4

During a forensic analysis, you find a 'shimcache' (AppCompatCache) entry for an executable that no longer exists on the disk. What does this confirm?

Accepted Answer

The file was executed on the system.. The Shimcache is designed to track application compatibility and is populated upon execution. An entry in the Shimcache confirms that a specific binary was present and executed on the system at some point, even if the file has been subsequently deleted. This is a critical artifact for establishing a timeline of activity, specifically for identifying malware that an attacker attempted to remove to hide their forensic tracks.

Answer

The file was blocked by AppLocker.

Answer

The file was a service that failed to start.

Answer

The system was infected by a rootkit.

Question 5

A security analyst observes a workstation periodically initiating outbound HTTPS connections to an external IP address at exactly 03:00 UTC. The forensic artifact shows the process associated with these connections is 'svchost.exe' with a PID that changes daily. Which indicator strongly suggests malicious activity rather than a standard scheduled task?

Accepted Answer

The parent process of the svchost.exe instance is not services.exe.. Standard Windows services initiated by svchost.exe typically reference a Service Host group and a specific DLL path found in the registry under HKLM\System\CurrentControlSet\Services. When the parent process structure is decoupled from the services.exe hierarchy, or when the binary location deviates from System32, it signals process injection or masquerading. Identifying these discrepancies is vital for isolating beaconing activity in sophisticated persistent threats that attempt to blend into normal system baseline traffic.

Answer

The connections utilize TLS 1.2 for all outbound communication.

Answer

The connections occur at a consistent, predictable daily interval.

Answer

The external IP address belongs to a cloud service provider.

Question 6

An analyst discovers a suspicious file named 'svchost.exe' located in 'C:\Users\Public\'. Why is this highly suspicious from a forensic standpoint?

Accepted Answer

The file name svchost.exe should only exist in the System32 directory.. Core Windows system binaries have a fixed, well-known path, primarily within System32. Placing a binary with a system name in a user-writable directory like Public is a common masquerading tactic. Attackers use this to evade detection by casual administrators who recognize the name but may overlook the path. Identifying incorrect file locations is a fundamental baseline check for forensic analysts during system triage and compromise assessment.

Answer

The file is an executable, which is forbidden in the Public folder.

Answer

The Public folder is not indexed by the Windows Search service.

Answer

Windows automatically deletes any binary named svchost.exe found outside System32.

Question 7

Which THREE of the following artifacts provide the most reliable evidence when determining if a specific user account was used to execute a malicious script?

Accepted Answer

PowerShell operational logs (Event ID 4104).. To definitively link a user to a script execution, an analyst must look for evidence of the execution itself, the user's login session, and the command history. Combining shell history, event logs, and forensic artifacts like Shimcache or Amcache allows the analyst to create a timeline of activity. This rigor is required because attackers often spoof timestamps or use shared accounts, necessitating multi-source validation to confirm actor attribution.

Answer

The size of the system pagefile.sys.

Answer

The content of the .bash_history file.

Question 8

An analyst finds an unusual entry in the Windows 'Run' registry key. What is the most effective next step to evaluate if this entry is malicious?

Accepted Answer

Check the binary associated with the registry key for a known vendor signature.. The Run registry key is a common persistence mechanism. Evaluating it requires verifying the binary integrity, checking the file path, and identifying the process behavior. This step is critical because many legitimate applications use these keys for startup, and misidentifying them as malicious creates false positives. Analysts must correlate registry data with file hashes and process tree analysis to reach an informed conclusion about the entry's intent.

Answer

Immediately delete the registry key to stop the persistence.

Answer

Run a full disk scan using a common consumer-grade antivirus tool.

Answer

Reboot the system to see if the registry entry persists.

Question 9

Which TWO of the following logs should an investigator review to identify potential lateral movement across an enterprise network?

Accepted Answer

Windows Security Event Logs (Logon events).. Lateral movement is often captured in authentication logs and remote service logs. Monitoring for 4624 events with specific logon types or service installation logs helps identify the progression of an attacker. This is critical because lateral movement is the phase where attackers transition from an initial foothold to the target data, and timely detection here is the best opportunity to contain the breach before it expands across the domain.

Answer

DNS query logs from the domain controller.

Answer

Application logs for the local web server.

Answer

DHCP lease logs.

Question 10

During an investigation of a Windows 10 workstation, a forensic analyst runs a tool that parses the NTFS $MFT and observes a file record whose $STANDARD_INFORMATION timestamps are all earlier than the corresponding $FILE_NAME timestamps by roughly 45 minutes. The file resides in C:\Windows\System32 and is named 'lsass.exe'. What is the most accurate interpretation of this timestamp discrepancy?

Accepted Answer

The file was likely timestomped, because an attacker can modify $STANDARD_INFORMATION timestamps with user-mode APIs while $FILE_NAME timestamps are only updated by the kernel during file creation or renaming.. A discrepancy where $STANDARD_INFORMATION timestamps are earlier than $FILE_NAME timestamps on a critical system binary is a classic timestomping indicator. Attackers use user-mode APIs to modify $STANDARD_INFORMATION, but the kernel-managed $FILE_NAME timestamps are harder to alter without specialized techniques. This pattern should prompt further analysis such as hash comparison and memory inspection.

Answer

The file is a legitimate Windows component that was copied from an installation media, which preserves original timestamps in $STANDARD_INFORMATION but writes new $FILE_NAME timestamps at copy time.

Answer

The system clock was adjusted backwards after the file was created, so the $STANDARD_INFORMATION timestamps reflect the corrected time.

Answer

The NTFS journal was replayed after an unclean shutdown, which caused $FILE_NAME timestamps to be refreshed while $STANDARD_INFORMATION timestamps remained unchanged.

Question 11

A forensic analyst is examining a Windows Server 2016 domain controller after reports of unauthorized access. The analyst has collected the Security.evtx log, the NTDS.dit file, and the SYSVOL folder. Which TWO artifacts would most directly provide evidence that a DCSync attack was performed? (Choose two.)

Accepted Answer

Security event ID 4662 with the Control Access Right GUID for DS-Replication-Get-Changes-All, generated by a user account that is not a domain controller.. DCSync is detected by looking for directory replication requests from accounts that are not domain controllers. Event ID 4662 with the Replicating Directory Changes All GUID or the DS-Replication-Get-Changes-All control access right GUID, especially when generated by a non-DC account, directly evidences the replication attempt. Other events like network logons or Kerberos ticket requests are too generic or relate to different attack techniques.

Answer

Security event ID 4624 with Logon Type 3 and the account name of a domain administrator.

Answer

Security event ID 5136 with the object class of user and the attribute samAccountName.

Answer

Security event ID 4769 with the service name krbtgt and encryption type 0x17.

Question 12

A forensic analyst is investigating a suspected compromised Windows system. The analyst observes the following artifacts: (1) A scheduled task named 'Updater' that runs a PowerShell script from a remote URL every hour. (2) A registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run containing an entry for 'C:\Users\Public\update.exe'. (3) A new local user account named 'Support' with administrative privileges. (4) A service named 'RemoteSvc' with a binary path pointing to 'C:\Windows\Temp\svc.exe'. Which TWO of these artifacts are most indicative of persistence mechanisms? (Choose two.)

Accepted Answer

The registry Run key entry for 'C:\Users\Public\update.exe'.. The scheduled task and the Run key entry are both established persistence mechanisms that ensure malicious code executes automatically. The scheduled task runs a remote script periodically, and the Run key launches an executable at logon. Both are commonly used by attackers to maintain access.

Answer

The presence of a PowerShell script that downloads and executes code from a remote URL.

Answer

A new local user account named 'Support' with administrative privileges.

Answer

A service named 'RemoteSvc' with a binary path pointing to 'C:\Windows\Temp\svc.exe'.

Question 13

You are examining a Windows 10 endpoint suspected of hosting a persistence mechanism. You have collected the SYSTEM and SOFTWARE registry hives plus the user NTUSER.DAT. Which two registry locations should you inspect to identify auto-start entries that execute at user logon and do not require administrative privileges? (Choose two.)

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce. The two per-user auto-start keys under NTUSER.DAT are writable by the account owner without elevation and execute at logon, matching the scenario constraints. The machine-wide equivalents require administrative rights, and the User Shell Folders key only redirects paths rather than launching processes. Examining the user hive is therefore essential when the suspect persistence is suspected to be non-privileged.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Answer

HKLM\SYSTEM\CurrentControlSet\Services

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Question 14

A forensic analyst is examining a memory dump from a Windows 10 system. The analyst uses Volatility and runs the 'netscan' plugin, which shows an established connection from PID 4321 (explorer.exe) to a remote IP address 203.0.113.5 on port 443. The analyst knows that explorer.exe is not typically associated with network connections. What is the most likely explanation for this finding?

Accepted Answer

explorer.exe has been injected with malicious code that is communicating with a command and control server.. The correct answer identifies that explorer.exe making an external network connection is likely due to process injection by malware. Attackers often inject into explorer.exe to hide their C2 traffic within a trusted process. This allows them to bypass security controls that might block unknown processes from making network connections.

Answer

explorer.exe is legitimately connecting to a Microsoft update server to check for Windows updates.

Answer

The connection is a false positive due to the way Volatility associates network connections with processes.

Answer

explorer.exe is being used by a legitimate application to download files from the internet.

Question 15

During an intrusion investigation on a Windows 10 workstation, you examine the USN Change Journal ($UsnJrnl:$J) and notice a cluster of DATA_OVERWRITE records for a file named 'invoice_2024.docx' in a user's Documents folder, followed immediately by a DATA_TRUNCATION record and then a series of DATA_EXTEND records with a filename that is no longer present on disk. Which activity does this sequence most likely represent?

Accepted Answer

The document was overwritten and the storage was reused to stage a malicious executable.. NTFS journals file content changes as reason codes, and the combination of DATA_OVERWRITE, DATA_TRUNCATION, and DATA_EXTEND under one filename indicates the original document's bytes were replaced and the storage was rebuilt to hold different, larger content. Because the filename no longer resolves on disk, the most defensible interpretation is that the file was repurposed to stage malicious code before being moved or deleted.

Answer

The document was defragmented by the NTFS optimizer during routine maintenance.

Answer

The document was overwritten with attacker tooling and then deleted to remove evidence.

Answer

The original document was encrypted in place by ransomware.