GCFA Multiple Select — 20 Questions

Question 1

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.. Sysmon ProcessAccess events targeting lsass.exe with access masks like 0x1010 or 0x1410 directly show attempts to read LSASS memory, which is central to credential dumping. Similarly, an lsass.dmp file created in a user-writable directory with a corresponding file creation event provides concrete evidence of memory dumping. Both artifacts are high-fidelity indicators of credential theft.

Answer

Windows Security event ID 4672 indicating special privileges assigned to a new logon for a service account.

Answer

Windows Security event ID 4688 with process creation for a known credential dumping tool, including its command line.

Answer

Windows Security event ID 4624 logon type 3 (network) from a workstation to the domain controller.

Question 2

Which THREE items are critical to inspect when analyzing a memory dump for evidence of Process Hollowing or Injection?

Accepted Answer

Memory Page Permissions (RWX). Process injection techniques often modify memory protections or inject code into existing legitimate processes. By comparing the disk-based image of a process with its memory-based representation, analysts can identify discrepancies in executable sections. Checking memory protections (e.g., RWX permissions) and identifying unbacked executable code in private memory regions are the primary methods for uncovering sophisticated persistent threats that operate entirely within the volatile memory space.

Answer

The system's Event Log files

Answer

The MFT file records

Question 3

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 4

An analyst is examining a memory image from a Windows 10 system that is suspected of being infected with malware that uses process hollowing. The analyst wants to identify processes that may have been hollowed. Which TWO of the following artifacts or techniques are most indicative of process hollowing? (Choose two.)

Accepted Answer

The process's image path in memory does not match the file path on disk.. Process hollowing involves creating a legitimate process in a suspended state, unmapping its memory, and injecting malicious code. This results in two key indicators: the in-memory image path may not match the disk file (or the memory content differs from disk), and threads execute from memory regions not backed by a file. These artifacts are directly tied to the hollowing technique and are detectable through memory analysis.

Answer

The process's token indicates it is running with elevated privileges.

Answer

The process's parent process ID (PPID) is a non-existent process.

Answer

The process has a large number of open handles to remote named pipes.

Question 5

Which TWO of the following are considered reliable methods for detecting hidden processes in memory forensics?

Accepted Answer

psscan pool tag analysis. Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

Answer

pslist enumeration

Answer

Task Manager API polling

Answer

Registry hive parsing

Question 6

An enterprise incident response team is preparing to contain a confirmed ransomware outbreak that has already encrypted several file servers. The team must preserve forensic evidence while stopping further spread. Which two actions best balance evidence preservation with containment in this scenario? (Choose two.)

Accepted Answer

Isolate affected servers from the network at the switch or EDR level while keeping them powered on. Isolating affected servers at the network layer stops the spread without destroying volatile evidence, and capturing memory before containment preserves fragile artifacts such as encryption keys and active processes. Together they satisfy containment and preservation. Powering off, reimaging, or deleting files would destroy evidence or recovery options and do not represent a balanced response.

Answer

Reimage all affected servers immediately to restore business operations

Answer

Immediately power off all affected servers to halt encryption activity

Answer

Delete all encrypted files to prevent the ransomware from spreading further

Question 7

A forensic analyst is triaging a Windows 10 endpoint that is suspected of being part of a botnet. The analyst has collected the Security, System, and Application event logs, the Sysmon operational log, and a live memory image. Which TWO of the following artifacts would provide the most direct evidence of periodic command-and-control beaconing behavior? (Choose two.)

Accepted Answer

Sysmon Event ID 3 (NetworkConnect) entries showing repeated connections to the same external IP at regular intervals.. Beaconing is characterized by repeated, regular communication from a host to an external controller. Sysmon network-connect events and DNS query events both capture the timing, destination, and initiating process needed to confirm that pattern directly from the endpoint. Logon, application-crash, and service-install events may support the broader investigation but do not, by themselves, demonstrate periodic outbound C2 traffic.

Answer

Application Event ID 1000 (Application Error) entries referencing a crashing service.

Answer

System Event ID 7045 (A service was installed in the system) recorded once during the investigation window.

Answer

Security Event ID 4624 (An account was successfully logged on) with Logon Type 3 repeated every few minutes.

Question 8

During a memory forensics investigation of a Windows 10 image, you suspect an attacker injected code into a legitimate process. Which TWO Volatility 3 plugins would you use together to detect and characterize the injected code? (Choose two.)

Accepted Answer

windows.vadinfo. windows.malfind finds executable memory regions not backed by a file, which is the signature of injected code, while windows.vadinfo provides the virtual address descriptor details for those regions, including protection and commit type. Using them together lets the analyst detect the injection and then characterize it as private, executable, and fileless within the target process.

Answer

windows.netscan

Answer

windows.handles

Answer

windows.registry.hivelist

Question 9

Which THREE activities are considered best practices when preserving evidence from a cloud-based environment during an incident?

Accepted Answer

Take snapshots of all attached volumes for forensic imaging.. Evidence preservation in cloud environments requires non-destructive methods that maintain chain of custody while ensuring data integrity. By creating snapshots, isolating the affected instance, and extracting memory, responders ensure that the state of the system is preserved for deep forensic analysis. These steps are crucial because cloud instances are ephemeral and can be easily deleted or modified, which would destroy the evidence necessary to build a complete incident timeline and identify the root cause.

Answer

Shut down the instance immediately to stop the attack.

Answer

Delete all ephemeral logs to save on cloud storage costs.

Question 10

Which THREE items are typically stored in a thread's TEB (Thread Environment Block)?

Accepted Answer

Thread Local Storage (TLS) pointers. The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

Answer

Active process list pointer

Answer

Kernel-mode privilege level

Question 11

Which TWO of the following actions are considered 'anti-forensic' techniques that directly impact file system timeline analysis?

Accepted Answer

Timestomping. Attackers utilize anti-forensic techniques to break the chain of evidence. Timestomping specifically invalidates the reliability of file metadata, while log clearing removes the context required for correlation. Both techniques force analysts to move deeper into secondary artifacts like the USN Journal or volume shadow copies, significantly increasing the time and complexity of an investigation while testing the analyst's ability to cross-reference multiple data sources for evidence.

Answer

Updating system drivers

Answer

Using a web browser

Answer

Renaming a file

Question 12

An analyst is preparing to acquire memory from a compromised server. Which TWO of the following factors are the most critical to consider regarding the integrity of the evidence and system stability?

Accepted Answer

The footprint of the acquisition tool in RAM. When performing memory acquisition, minimizing the footprint on the target system is essential to prevent the overwriting of volatile artifacts. Furthermore, the selection of the acquisition tool must account for potential security software interference that could cause a system crash or trigger alerts. These factors ensure that the resulting image is a forensically sound representation of the system state at the time of capture, avoiding unnecessary collateral damage to the evidence.

Answer

The bit-depth of the monitor attached to the server

Answer

The total capacity of the hard drive

Answer

The current time zone of the server

Question 13

During an enterprise incident response, you are tasked with collecting volatile evidence from a compromised Windows workstation. Which two of the following are considered best practices for preserving volatile data? (Choose two.)

Accepted Answer

Run 'netstat -ano' to record active network connections and associated process IDs.. Capturing physical memory and recording active network connections are both essential for preserving volatile evidence. Memory contains running processes, encryption keys, and injected code, while netstat reveals current network activity that may indicate command-and-control or lateral movement. These steps should be performed before any action that alters the system state, such as shutdown or disconnection.

Answer

Immediately shut down the system to prevent further malicious activity and then create a forensic image of the hard drive.

Answer

Use a write blocker when connecting the hard drive to a forensic workstation to create a bit-for-bit image.

Answer

Disconnect the workstation from the network before capturing any volatile data to prevent data leakage.

Question 14

An enterprise incident response team is preparing to conduct a forensic investigation on a compromised Linux server. The server is still running and cannot be taken offline. Which TWO of the following commands are appropriate for collecting volatile network connection information while minimizing disruption to the system? (Choose two.)

Accepted Answer

netstat -antp. netstat and ss are standard tools for capturing volatile network connection information on a live Linux system. Both provide details on active connections, listening ports, and associated processes without generating new traffic or causing significant system disruption. They are commonly used in incident response to document the current network state before further analysis.

Answer

nmap -sS 127.0.0.1

Answer

lsof -i

Answer

tcpdump -i any -w capture.pcap

Question 15

During an enterprise incident response involving a compromised Windows server, you need to acquire volatile evidence in a forensically sound manner. Which TWO of the following actions should be performed first to preserve the most volatile data? (Choose two.)

Accepted Answer

Capture the contents of physical memory (RAM) using a tool like WinPmem or DumpIt.. The order of volatility dictates that physical memory and active network connections are the most perishable. Capturing RAM preserves running processes and encryption keys, while recording network connections captures transient command-and-control activity. These two actions must be performed first to prevent loss of critical evidence before moving to less volatile sources like disk images or event logs.

Answer

Export the Windows Event Logs to a secure location.

Answer

Take screenshots of the desktop and open applications.

Answer

Create a forensic image of the system drive using FTK Imager or dd.

Question 16

An incident responder is investigating a compromised Windows server. The attacker gained access via a Remote Desktop Protocol (RDP) brute-force attack and then created a new local user account for persistence. The responder needs to identify evidence of the newly created account and any subsequent logon activity. Which TWO of the following Windows artifacts should the responder examine to find this evidence? (Choose two.)

Accepted Answer

SAM registry hive. The Security event log records account creation (4720) and logon events (4624), providing a timeline of the attacker's actions. The SAM registry hive stores the local account database, including the new account's details, and can be analyzed even if logs are cleared. Together, they offer direct evidence of the new account and its use, which is critical for understanding the persistence mechanism.

Answer

Application event log (Event ID 1000)

Answer

System event log (Event ID 7045)

Answer

Prefetch files

Question 17

An analyst is reconstructing a suspected credential-dumping incident on a Windows 10 host and has already imaged memory. Which TWO artifacts should the analyst examine to determine whether the LSASS process memory was accessed by an unauthorized tool? (Choose two.)

Accepted Answer

A memory image search for the 'sekurlsa' module strings and Mimikatz driver artifacts in non-paged pool.. Establishing unauthorized LSASS access requires artifacts that either record the access event itself or demonstrate the presence of credential-dumping tooling. Sysmon process-access events capture the target process, requesting image, and granted access mask, while memory-resident strings and driver artifacts left by frameworks like Mimikatz show the tooling was loaded. Together they provide both the access event and the capability evidence.

Answer

Prefetch files showing that the Windows Credential Manager UI was launched by the user.

Answer

Security Event ID 4688 process creation records showing the parent image of every long-running service.

Answer

Amcache entries listing hashes of binaries installed under 'Program Files' on the host.

Question 18

An examiner is reviewing a Windows memory image for evidence of process hollowing. Which two artifacts, when observed together, most strongly support that a process has been hollowed? (Choose two.)

Accepted Answer

The process's primary image memory region is not backed by the file on disk that its path indicates.. Process hollowing unmaps or overwrites the original image and injects replacement code, so the primary image region loses its legitimate file backing and threads often start in unbacked memory. Observing both an unbacked primary image and a thread starting outside known modules forms a coherent, high-confidence pattern. Pipe handles, token privilege changes, and working set size are unrelated to the hollowing technique.

Answer

The process's token has been modified to include SeDebugPrivilege.

Answer

The process has a working set larger than the system average.

Answer

The process has a large number of handles open to named pipes.

Question 19

A forensic analyst is examining a memory image from a Windows 10 system suspected of having a rootkit that hides processes by unlinking them from the active process list. The analyst runs windows.pslist and windows.psscan to compare results. Which two of the following statements accurately describe the expected findings or implications? (Choose two.)

Accepted Answer

Processes present in windows.psscan but absent in windows.pslist are likely hidden by rootkit activity.. The correct statements highlight that windows.psscan can reveal processes hidden from the active list and may also report terminated processes whose structures remain. These behaviors are essential for detecting rootkits that unlink processes. The other statements contain factual errors about the tools' methods or draw unsupported conclusions from identical output.

Answer

Processes present in windows.pslist but absent in windows.psscan indicate that the process terminated normally and its memory was freed.

Answer

If windows.psscan and windows.pslist produce identical output, it definitively proves that no rootkit is present on the system.

Answer

windows.pslist relies on pool tag scanning, while windows.psscan walks the active process list.

Question 20

A forensic analyst is examining an NTFS volume and wants to identify potential timestomping. Which TWO artifacts should the analyst compare to detect inconsistencies in file timestamps? (Choose two.)

Accepted Answer

$FILE_NAME timestamps. Timestomping often modifies $STANDARD_INFORMATION timestamps while leaving $FILE_NAME timestamps unchanged. Comparing these two sets can reveal inconsistencies that indicate manipulation. Other artifacts like VBR, $Bitmap, or MFT record headers do not contain comparable per-file timestamps, so they are not useful for this specific detection.

Answer

Volume Boot Record (VBR) timestamps

Answer

$Bitmap timestamps

Answer

Master File Table (MFT) record header timestamps