GCFA Identification of Malicious and Normal Activity Practice Test 2 — 15 Questions

Question 1

During a forensic investigation of a Windows 10 workstation, an analyst examines the $MFT and discovers that the file record for a suspicious executable shows a Standard Information Attribute (SIA) creation timestamp that is later than its Filename Attribute (FNA) creation timestamp. The executable resides in C:\Windows\Temp. Which of the following best explains this discrepancy and its forensic significance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The file was created normally, but the SIA timestamp was later modified by a user-mode application using SetFileTime API, while the FNA timestamp remained unchanged; this is a classic timestomping indicator.. The discrepancy where the Standard Information Attribute (SIA) creation timestamp is later than the Filename Attribute (FNA) creation timestamp is a known indicator of timestomping. Tools that manipulate timestamps often modify the SIA but not the FNA, which is stored in the directory entry and harder to alter. This artifact, especially for a file in a suspicious location like C:\Windows\Temp, warrants further investigation.

Answer

The file was moved from another NTFS volume, and the FNA timestamp reflects the original creation time while the SIA timestamp reflects when it was moved to this volume; this is normal NTFS behavior and not indicative of timestomping.

Answer

The file was downloaded from the internet, and the SIA timestamp reflects when the download completed while the FNA timestamp reflects when the file was first written to disk; this is a normal artifact of browser downloads.

Answer

The file was copied from another NTFS volume, and the FNA timestamp reflects the original creation time while the SIA timestamp reflects when it was written to this volume; this is a timestomping indicator.

Question 2

An analyst is examining a Windows Server 2016 domain controller and finds that the Security event log contains event ID 4624 with Logon Type 3 and an Account Name that matches a domain user. The analyst suspects this logon was the result of a Pass-the-Hash attack. Which additional artifact, when correlated with this event, would most strongly support that conclusion?

Accepted Answer

A network logon (Type 3) that is not preceded by an interactive logon (Type 2) for the same account on the source system. Pass-the-Hash allows an attacker to authenticate using an NTLM hash without knowing the plaintext password, typically resulting in a network logon (Type 3) on the target. Legitimate network logons are usually preceded by an interactive logon (Type 2) on the source system where the user typed their password. When a Type 3 logon appears without a corresponding Type 2 on the source, it suggests the hash was used directly, which is a hallmark of Pass-the-Hash. Correlating the absence of a prior interactive logon with the network logon strengthens the conclusion.

Answer

The absence of a corresponding event ID 4648 (A logon was attempted using explicit credentials) for the same user

Answer

A preceding event ID 4625 (An account failed to log on) from the same source IP

Answer

A corresponding event ID 4672 (Special privileges assigned to new logon) for the same session

Question 3

An analyst is investigating a suspected data exfiltration incident on a Windows server. The analyst observes that a scheduled task named 'WindowsUpdateCheck' was created and configured to run a PowerShell script every hour. The script connects to an external IP address and uploads files from a sensitive directory. The analyst wants to determine when this scheduled task was created and what user account was used to create it. Which artifact should the analyst examine to find this information?

Accepted Answer

The Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational) for event ID 106 (Task registered). The Task Scheduler operational log event ID 106 is generated when a task is registered and includes the task name, the user account that registered it, and a timestamp. This directly provides the creation time and the responsible user account. While the Security log event 4698 also records task creation, it depends on audit policy and may not be enabled. File system timestamps lack user attribution, and PowerShell script block logging does not record task registration.

Answer

The Security event log for event ID 4698 (A scheduled task was created)

Answer

The file system timestamps of the task file in C:\Windows\System32\Tasks

Answer

The PowerShell operational log for event ID 4104 (Script block logging) showing the script creation

Question 4

A forensic analyst is investigating a compromised Windows 10 host and suspects the attacker used Windows Management Instrumentation (WMI) for persistence and lateral movement. Which TWO of the following artifacts should the analyst examine to identify WMI-based persistence and execution? (Choose two.)

Accepted Answer

The Windows event log for WMI-Activity operational logs, specifically event ID 5861, which logs the creation of permanent event subscriptions.. WMI persistence via permanent event subscriptions leaves artifacts in the WMI repository (OBJECTS.DATA) and, if enabled, in the WMI-Activity operational log (event ID 5861). The repository is the definitive source for subscriptions, while the event log provides a record of their creation. Together, these artifacts allow an analyst to identify malicious WMI persistence.

Answer

The Windows Security event log for event ID 4688 with the process name 'WmiPrvSE.exe' and a command line containing 'scrcons.exe'.

Answer

The registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WMI\Subscriptions, which stores all WMI event subscriptions.

Answer

The file system artifacts in C:\Windows\System32\wbem\Logs, including the 'wmiprvse.log' and 'scrcons.log' files.

Question 5

An analyst reviewing Windows event logs on a compromised workstation discovers a sudden spike in Event ID 4624 with Logon Type 3, followed immediately by Event ID 4672. The source IP address belongs to a non-routable internal subnet. Which forensic interpretation best explains this activity?

Accepted Answer

An adversary performed lateral movement using stolen administrative credentials over the network to access administrative shares.. This specific sequence indicates a network logon successfully authenticating an administrative user, frequently observed during lateral movement via SMB or PsExec. Understanding this pattern allows analysts to differentiate authorized administrative maintenance from credential-based attacks, mapping directly to attacker tactics in enterprise environments.

Answer

An interactive user logged into the local console, triggering default privilege escalation assignments.

Answer

A scheduled batch job executed locally using stored credentials without generating network authentication traffic.

Answer

A service account automatically restarted following a system crash, initiating local service control manager requests.

Question 6

An analyst identifies a process performing unexpected DNS queries to a top-level domain ending in .xyz every 60 seconds. What is the most effective initial host-based action to confirm malicious beaconing?

Accepted Answer

Correlate the DNS query timestamps with socket ownership via netstat or EDR telemetry.. Isolating the process behavior through network connection correlation allows the analyst to map the C2 traffic to a specific binary. Identifying the parent process and local socket ownership is essential to distinguish between legitimate background tasks and automated beaconing activity. This helps narrow the scope of the investigation by confirming the persistence mechanism and the specific threat actor communication pattern associated with the compromised host.

Answer

Perform a full disk imaging of the host immediately.

Answer

Execute an immediate reboot of the affected system.

Answer

Flush the local DNS resolver cache on the host.

Question 7

Refer to the exhibit. An analyst observes this process execution on a domain controller. What indicator suggests this activity is likely malicious?

Accepted Answer

The process is establishing an outbound connection to an external IP address.. While svchost.exe is a legitimate Windows service host, the network connection originating from a domain controller to an external IP address is highly suspicious. Legitimate domain controller service traffic should be directed towards internal domain members or approved update servers. This specific pattern, combined with the process context, indicates potential lateral movement or data exfiltration attempts using a masqueraded system process to bypass basic security controls.

Answer

The process is running as NT AUTHORITY\SYSTEM.

Answer

The parent process is services.exe.

Answer

The process is using a high-numbered ephemeral port.

Question 8

Which log artifact provides the most reliable evidence that a user account was used for an interactive remote login rather than a scheduled task?

Accepted Answer

Event ID 4624 with Logon Type 10.. The Windows Security Event log captures specific Logon Types that categorize the nature of the authentication. Logon Type 2 denotes an interactive local login, while Type 10 identifies Remote Interactive (RDP) sessions. Scheduled tasks typically utilize Type 4 (Batch) or Type 5 (Service), allowing analysts to differentiate between user-driven activity and automated system processes through forensic inspection of the event data.

Answer

Event ID 4672 during the authentication process.

Answer

Event ID 4648 involving the use of explicit credentials.

Answer

Event ID 4720 occurring at the same time.

Question 9

An analyst observes PowerShell usage with the encoded command flag '-e'. What is the standard forensic approach to de-obfuscate and analyze this activity?

Accepted Answer

Use a base64 decoder to convert the command string to plaintext.. Base64 encoded PowerShell commands are a common tactic to bypass signature-based detection. The analyst must extract the encoded string, decode it using standard utilities like CyberChef or PowerShell itself, and then perform static analysis on the resulting script. This process is vital to understand the attacker's intent, such as identifying hidden C2 downloaders, persistence scripts, or data collection commands that were otherwise obscured from basic text-based log searches.

Answer

Run the script directly in a production environment to see its effect.

Answer

Search for the command in the Windows Update history.

Answer

Check the local BIOS/UEFI logs for the command execution.

Question 10

Which THREE of the following are considered 'living-off-the-land' (LotL) techniques used by attackers to avoid detection?

Accepted Answer

Utilizing WMI (Windows Management Instrumentation) to execute remote commands.. LotL techniques leverage legitimate, pre-installed administrative tools to perform malicious actions. Because these binaries are signed and expected to be present in the environment, traditional endpoint protection often ignores them. Attackers use these tools for discovery, lateral movement, and execution, effectively hiding their activity in the noise of normal system administration tasks, which makes them highly effective for stealthy operations within a compromised network.

Answer

Installing a custom kernel-mode rootkit for persistence.

Answer

Running a custom C++ backdoor compiled on the target.

Question 11

When reviewing firewall logs, what activity should be flagged as an immediate indicator of a potential port scan?

Accepted Answer

A high frequency of connection attempts from one source to many destination ports.. A port scan involves a single source IP attempting to connect to a large range of destination ports in a short timeframe. Firewall logs showing a spike in 'Denied' or 'Dropped' connection attempts from one host to many different targets is a classic signature. Identifying this helps analysts catch reconnaissance activity early before the attacker transitions to active exploitation of a specific vulnerable service.

Answer

Multiple successful inbound connections to port 80.

Answer

A single connection to a database port from an internal host.

Answer

Periodic outbound traffic to a known DNS server.

Question 12

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Accepted Answer

The usage of 'IEX' to execute code in memory.. The command performs an 'In-Process' download and execution of a remote PowerShell script. By using 'IEX' (Invoke-Expression) combined with a web client download, the attacker executes the script directly in memory, bypassing the need to write a file to disk. This is a highly effective evasion technique that leaves minimal forensic footprint and is a standard delivery method for sophisticated, memory-resident malware payloads.

Answer

The usage of the 'echo' command.

Answer

The creation of a text file in C:\Users\Public.

Answer

The command uses the 'hidden' window flag.

Question 13

Which log category should an analyst examine to identify a potential 'Pass-the-Hash' attack?

Accepted Answer

Security event logs for Event ID 4624.. Pass-the-Hash attacks involve an attacker using an NTLM hash to authenticate as a user without the cleartext password. This typically manifests in the Security event log during the authentication process. By looking for specific logon types and unusual source-to-destination authentication flows, analysts can detect when a hash has been reused across the network, even if the attacker never obtained the actual password through brute force or phishing.

Answer

System event logs for service failures.

Answer

Application event logs for crash dumps.

Answer

DNS query logs from the domain controller.

Question 14

What is the primary forensic value of examining MFT (Master File Table) $Standard_Information vs $File_Name attributes?

Accepted Answer

Discrepancies often reveal timestomping attempts by attackers.. The MFT contains two primary timestamps for each file: Standard Information (SI) and File Name (FN). Attackers often use 'timestomping' tools to modify the SI attributes to match legitimate files and hide their tracks. However, they frequently forget or are unable to modify the FN attributes, which are less accessible. Discrepancies between these timestamps are a definitive indicator of anti-forensic activity that analysts use to uncover hidden malicious file creation times.

Answer

SI attributes are updated by the OS, while FN attributes are static.

Answer

FN attributes are the only way to recover deleted files.

Answer

SI attributes are required for NTFS file permissions.

Question 15

Which indicator is most effective for identifying a 'Golden Ticket' attack during Kerberos-based authentication?

Accepted Answer

Unusually long ticket lifetimes in the Kerberos ticket history.. A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created with a compromised KRBTGT account hash. Because it is forged, it can grant the attacker unlimited access to any resource in the domain for long periods. Identifying this requires looking for tickets with unusually long lifetimes, or tickets that do not match the standard issuance patterns expected from the domain controller's authentication logs during normal operations.

Answer

Multiple failed login attempts on a workstation.

Answer

An increase in web traffic on port 443.

Answer

The presence of a new user account in Active Directory.