GCFA Windows Artifact Analysis — All Questions With Answers

Question 1mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a suspicious executable in a user's AppData folder. Which Windows artifact should be examined first to determine if the file was executed via a specific user action or a scheduled task?

Question 2hardmulti select

Read the full Windows Artifact Analysis explanation →

Which TWO of the following artifacts are most effective for identifying file system activity that occurred immediately before a system shutdown or sudden crash?

Question 3mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. Based on the USN Journal output, what can the analyst conclude about the file 'secret_data.docx'?

Exhibit

C:\> fsutil usn readjournal C:\ /N
... 
File Name: secret_data.docx 
Reason: DataExtend, FileCreate, DataOverwrite, Close
Time: 2023-10-12 14:22:05

Question 4hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a compromised system and finds that the 'LastWrite' time of a specific registry key has been modified to match the surrounding keys. Which artifact should be checked to detect this timestomping attempt?

Question 5mediummulti select

Read the full Windows Artifact Analysis explanation →

Which THREE pieces of information can be extracted from a parsed Windows 'Jump List' artifact?

Question 6mediummultiple choice

Read the full VPN explanation →

An analyst is investigating an unauthorized remote connection. Which artifact, located in the SYSTEM hive, provides evidence of network interface configuration changes that might indicate an attacker-controlled VPN or bridge?

Question 7hardmultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. An attacker modified the SpecialPollInterval value. What is the primary forensic implication of this change on a compromised system?

Exhibit

C:\Windows\System32\config\system
ControlSet001\Services\W32Time\TimeProviders\NtpClient
SpecialPollInterval: 3600

Question 8hardmulti select

Read the full Windows Artifact Analysis explanation →

Which THREE artifacts are essential for identifying the presence and execution of 'Living off the Land' (LotL) binaries like PowerShell or WMI on a Windows host?

Question 9hardmultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. What is the significance of the 'LastWrite' time for this specific registry key?

Exhibit

C:\Windows\System32\config\SYSTEM
ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Cruzer_Glide
LastWrite Time: 2023-09-15 09:12:33

Question 10hardmultiple choice

Read the full Windows Artifact Analysis explanation →

When reviewing 'ShimCache' (AppCompatCache), what does an entry with an empty 'Last Modified' time suggest to an investigator?

Question 11mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which Windows artifact should an analyst investigate to identify the specific time a user last modified a local folder's view settings?

Question 12hardmulti select

Read the full Windows Artifact Analysis explanation →

Which TWO of the following artifacts are most reliable for determining user-initiated file execution on a Windows 10 system?

Question 13mediummulti select

Read the full Windows Artifact Analysis explanation →

Which THREE of the following items are commonly found within the Windows Prefetch file structure?

Question 14mediummultiple choice

Read the full Windows Artifact Analysis explanation →

What is the primary forensic value of the Amcache.hve hive when investigating software installation on Windows 10?

Question 15hardmulti select

Read the full Windows Artifact Analysis explanation →

Which THREE of the following items can typically be extracted from a LNK file during a forensic investigation?

Question 16hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Question 17mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 workstation that is suspected of being used to exfiltrate data via a user-installed cloud-sync client. The analyst wants to correlate the exact times when files were added to a synced folder with network activity. Which Windows artifact should the analyst examine first to obtain the most direct record of individual file operations performed by that application?

Question 18hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system for evidence of a file that was recently deleted. The analyst suspects the file was removed using a command-line tool. Which artifact should be examined to determine the original path and deletion time of the file, assuming the file was deleted from an NTFS volume?

Question 19hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system suspected of being compromised. The analyst finds that the file `C:\Windows\System32\winevt\Logs\Security.evtx` has been deleted. A quick check of the volume shadow copies shows no recent copies. Which artifact should the analyst examine next to determine if the Security event log was cleared, and to recover potentially relevant event records?

Question 20easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and wants to determine which user account was used to run a specific program that left a prefetch file. The prefetch file is named NOTEPAD.EXE-1A2B3C4D.pf. Which artifact should the analyst examine to correlate the prefetch execution with a user account?

Question 21hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a compromised Windows Server 2019 domain controller. The attacker reportedly used a PowerShell script to create a scheduled task that runs a malicious binary. The analyst has recovered the Task Scheduler operational log and the XML task definition. Which artifact should the analyst examine to determine the exact user account that registered the task, including the security identifier (SID)?

Question 22easymultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is examining a Windows 10 system and needs to determine which user account was used to run a specific program. The program was executed via a shortcut on the desktop, and the investigator has access to the user's NTUSER.DAT hive. Which registry key should be examined to find the most recently accessed programs via the Run dialog or Windows Explorer?

Question 23mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst wants to identify remote execution attempts via SMB and scheduled tasks. Which TWO artifacts should be examined to find traces of remote scheduled task creation and execution? (Choose two.)

Question 24mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and finds that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. The analyst wants to determine which files were recently opened by the user. Which additional artifact should the analyst examine to correlate the file names with the applications used to open them?

Question 25mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a forensic examination of a Windows 10 system, an analyst notices that the Windows Event Log service is not running, and many event log files are missing. Which artifact can still provide evidence of historical system events and application execution?

Question 26easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and wants to determine the last time a specific USB storage device was connected to the system. The analyst has the device's serial number. Which registry artifact should the analyst examine to find this information?

Question 27easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system that was compromised via a malicious macro in a Microsoft Word document. The analyst wants to determine the original source of the document, such as whether it was downloaded from the internet or received via email. Which Windows artifact should the analyst examine to find the Zone.Identifier alternate data stream?

Question 28hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The attacker used PsExec to execute commands on remote systems. The analyst has access to the Security event logs from the target system. Which TWO event IDs should the analyst focus on to identify the initial PsExec service installation and subsequent service execution? (Choose two.)

Question 29hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to execute commands on remote systems. Which TWO artifacts should the analyst examine to confirm PsExec execution on the target system? (Choose two.)

Question 30hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable, but the entry lacks a timestamp. What is the most likely reason for the missing timestamp?

Question 31hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of data exfiltration. The analyst discovers that a user recently accessed several files on a sensitive network share. Which artifact should the analyst examine to determine the specific files and folders that were accessed, and the timestamps of those accesses?

Question 32hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of data exfiltration via a USB device. The analyst has already determined that a USB mass storage device was connected. Which two artifacts should the analyst examine to determine the volume serial number and the drive letter assigned to the USB device? (Choose two.)

Question 33hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system that may have been compromised via a malicious USB device. The analyst wants to determine the volume serial number and the last time a USB mass storage device was connected. Which registry key should the analyst examine to find this information?

Question 34mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When analyzing the 'TypedPaths' registry key, what type of user activity is being reviewed?

Question 35mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a file on a system that appears to be a 'hidden' executable. Which attribute of the NTFS file system, if modified, is a common indicator of a user attempting to conceal a file from standard Explorer views?

Question 36mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which artifact is the most reliable for determining if an external USB mass storage device was mounted on a system, even if the device is no longer present?

Question 37mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which registry hive contains the 'UserAssist' key, and what is its primary forensic value?

Question 38mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a suspicious executable in the C:\Users\Public folder. To determine if the file was executed, the analyst examines the Shimcache. Which behavior is characteristic of the Shimcache artifact?

Question 39hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is analyzing the Windows Event Logs and finds Event ID 4697. What is the primary significance of this event in the context of forensic analysis?

Question 40mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When reviewing Jump Lists on a Windows system, which file extension is commonly associated with the 'AutomaticDestinations' folder?

Question 41mediummultiple choice

Read the full Windows Artifact Analysis explanation →

What is the primary function of the ShellBags artifact in a Windows forensic investigation?

Question 42mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When analyzing the Windows Registry, what is the primary purpose of the 'SAM' hive?

Question 43mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?

Question 44mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During an intrusion investigation, an analyst needs to determine the exact moment a malicious service was installed on a Windows 10 host. The attacker deleted the service's executable and cleared the System event log. Which artifact should the analyst examine to recover the service installation timestamp?

Question 45mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a compromise investigation, an analyst reviews Windows Event Logs and observes that Security Event ID 4688 entries are present, but the Process Command Line field is empty for all of them. The system is running Windows 10 Enterprise. What is the most likely reason for the missing command line data?

Question 46mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 workstation that is suspected of having a malicious service installed for persistence. The analyst wants to determine the original path of the service executable and the account it runs under. Which registry location should the analyst examine to find this information?

Question 47mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a forensic examination of a Windows 10 workstation, an analyst needs to determine which user account was interactively logged on at a specific date and time. The system is powered off and only the disk image is available. Which artifact should the analyst examine to find the most reliable record of interactive logon sessions, including logon type and timestamp?

Question 48mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is reviewing a Windows 10 endpoint and finds that a scheduled task was created to run a PowerShell script at logon. The task was likely created by an attacker to maintain persistence. Which artifact should the analyst examine to determine the exact time the task was registered and the user account that created it?

Question 49mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 host and finds that a suspicious process was launched shortly after a user logged on. To determine the exact time the process was created and capture its parent-child relationship, which artifact should the analyst prioritize?

Question 50hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is analyzing a Windows 10 system where an attacker allegedly used a PowerShell script to download and execute a malicious payload. The investigator wants to determine the exact PowerShell commands that were executed. Which Windows artifact should the investigator examine to find this information?

Question 51easymultiple choice

Read the full Windows Artifact Analysis explanation →

A forensic analyst is examining a Windows 10 system and wants to determine which USB storage devices have been connected to the machine. The analyst has access to the registry. Which registry key should the analyst examine to find a list of USB devices that have been connected, including vendor and product IDs?

Question 52mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system to determine if a specific USB device was connected. The analyst has already checked the registry and found no trace in USBSTOR. Which TWO additional artifacts should the analyst examine to corroborate USB device connection? (Choose two.)

Question 53hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and discovers that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. What is the primary forensic significance of this artifact?

Question 54easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is reviewing a Windows 10 system and wants to determine the last time a user accessed a specific file. The analyst examines the file's NTFS standard information attributes and finds that the last access time is not updated. What is the most likely reason for this?

Question 55mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and finds a suspicious shortcut file in a user's Recent folder. The analyst wants to determine the full path of the target file and any command-line arguments used when the shortcut was created. Which artifact should the analyst examine?

Question 56mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to remotely execute commands on the system. Which TWO artifacts should the analyst examine to corroborate this activity? (Choose two.)

Question 57hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system to determine if a specific user account was used to access files on a remote share. Which two artifacts would provide the most direct evidence of this activity? (Choose two.)

Question 58easymultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is examining a Windows 10 system and finds a prefetch file named 'POWERSHELL.EXE-12345678.pf' in the C:\Windows\Prefetch folder. What is the primary forensic value of this artifact?

Question 59mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system where an attacker allegedly used a remote access tool (RAT) that persists by modifying the Image File Execution Options (IFEO) registry key. The analyst wants to identify which executable was hijacked. Which registry location should the analyst examine to find the Debugger value that redirects execution?

Question 60mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?

Question 61hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable. The analyst wants to determine whether the executable was actually executed on the system. Which additional artifact should the analyst examine to confirm execution?

Question 1mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a suspicious executable in a user's AppData folder. Which Windows artifact should be examined first to determine if the file was executed via a specific user action or a scheduled task?

Question 2hardmulti select

Read the full Windows Artifact Analysis explanation →

Which TWO of the following artifacts are most effective for identifying file system activity that occurred immediately before a system shutdown or sudden crash?

Question 3mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. Based on the USN Journal output, what can the analyst conclude about the file 'secret_data.docx'?

Exhibit

C:\> fsutil usn readjournal C:\ /N
... 
File Name: secret_data.docx 
Reason: DataExtend, FileCreate, DataOverwrite, Close
Time: 2023-10-12 14:22:05

Question 4hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a compromised system and finds that the 'LastWrite' time of a specific registry key has been modified to match the surrounding keys. Which artifact should be checked to detect this timestomping attempt?

Question 5mediummulti select

Read the full Windows Artifact Analysis explanation →

Which THREE pieces of information can be extracted from a parsed Windows 'Jump List' artifact?

Question 6mediummultiple choice

Read the full VPN explanation →

An analyst is investigating an unauthorized remote connection. Which artifact, located in the SYSTEM hive, provides evidence of network interface configuration changes that might indicate an attacker-controlled VPN or bridge?

Question 7hardmultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. An attacker modified the SpecialPollInterval value. What is the primary forensic implication of this change on a compromised system?

Exhibit

C:\Windows\System32\config\system
ControlSet001\Services\W32Time\TimeProviders\NtpClient
SpecialPollInterval: 3600

Question 8hardmulti select

Read the full Windows Artifact Analysis explanation →

Which THREE artifacts are essential for identifying the presence and execution of 'Living off the Land' (LotL) binaries like PowerShell or WMI on a Windows host?

Question 9hardmultiple choice

Read the full Windows Artifact Analysis explanation →

Refer to the exhibit. What is the significance of the 'LastWrite' time for this specific registry key?

Exhibit

C:\Windows\System32\config\SYSTEM
ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Cruzer_Glide
LastWrite Time: 2023-09-15 09:12:33

Question 10hardmultiple choice

Read the full Windows Artifact Analysis explanation →

When reviewing 'ShimCache' (AppCompatCache), what does an entry with an empty 'Last Modified' time suggest to an investigator?

Question 11mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which Windows artifact should an analyst investigate to identify the specific time a user last modified a local folder's view settings?

Question 12hardmulti select

Read the full Windows Artifact Analysis explanation →

Which TWO of the following artifacts are most reliable for determining user-initiated file execution on a Windows 10 system?

Question 13mediummulti select

Read the full Windows Artifact Analysis explanation →

Which THREE of the following items are commonly found within the Windows Prefetch file structure?

Question 14mediummultiple choice

Read the full Windows Artifact Analysis explanation →

What is the primary forensic value of the Amcache.hve hive when investigating software installation on Windows 10?

Question 15hardmulti select

Read the full Windows Artifact Analysis explanation →

Which THREE of the following items can typically be extracted from a LNK file during a forensic investigation?

Question 16hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Question 17mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 workstation that is suspected of being used to exfiltrate data via a user-installed cloud-sync client. The analyst wants to correlate the exact times when files were added to a synced folder with network activity. Which Windows artifact should the analyst examine first to obtain the most direct record of individual file operations performed by that application?

Question 18hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system for evidence of a file that was recently deleted. The analyst suspects the file was removed using a command-line tool. Which artifact should be examined to determine the original path and deletion time of the file, assuming the file was deleted from an NTFS volume?

Question 19hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system suspected of being compromised. The analyst finds that the file `C:\Windows\System32\winevt\Logs\Security.evtx` has been deleted. A quick check of the volume shadow copies shows no recent copies. Which artifact should the analyst examine next to determine if the Security event log was cleared, and to recover potentially relevant event records?

Question 20easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and wants to determine which user account was used to run a specific program that left a prefetch file. The prefetch file is named NOTEPAD.EXE-1A2B3C4D.pf. Which artifact should the analyst examine to correlate the prefetch execution with a user account?

Question 21hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a compromised Windows Server 2019 domain controller. The attacker reportedly used a PowerShell script to create a scheduled task that runs a malicious binary. The analyst has recovered the Task Scheduler operational log and the XML task definition. Which artifact should the analyst examine to determine the exact user account that registered the task, including the security identifier (SID)?

Question 22easymultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is examining a Windows 10 system and needs to determine which user account was used to run a specific program. The program was executed via a shortcut on the desktop, and the investigator has access to the user's NTUSER.DAT hive. Which registry key should be examined to find the most recently accessed programs via the Run dialog or Windows Explorer?

Question 23mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst wants to identify remote execution attempts via SMB and scheduled tasks. Which TWO artifacts should be examined to find traces of remote scheduled task creation and execution? (Choose two.)

Question 24mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and finds that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. The analyst wants to determine which files were recently opened by the user. Which additional artifact should the analyst examine to correlate the file names with the applications used to open them?

Question 25mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a forensic examination of a Windows 10 system, an analyst notices that the Windows Event Log service is not running, and many event log files are missing. Which artifact can still provide evidence of historical system events and application execution?

Question 26easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and wants to determine the last time a specific USB storage device was connected to the system. The analyst has the device's serial number. Which registry artifact should the analyst examine to find this information?

Question 27easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system that was compromised via a malicious macro in a Microsoft Word document. The analyst wants to determine the original source of the document, such as whether it was downloaded from the internet or received via email. Which Windows artifact should the analyst examine to find the Zone.Identifier alternate data stream?

Question 28hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The attacker used PsExec to execute commands on remote systems. The analyst has access to the Security event logs from the target system. Which TWO event IDs should the analyst focus on to identify the initial PsExec service installation and subsequent service execution? (Choose two.)

Question 29hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to execute commands on remote systems. Which TWO artifacts should the analyst examine to confirm PsExec execution on the target system? (Choose two.)

Question 30hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable, but the entry lacks a timestamp. What is the most likely reason for the missing timestamp?

Question 31hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of data exfiltration. The analyst discovers that a user recently accessed several files on a sensitive network share. Which artifact should the analyst examine to determine the specific files and folders that were accessed, and the timestamps of those accesses?

Question 32hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of data exfiltration via a USB device. The analyst has already determined that a USB mass storage device was connected. Which two artifacts should the analyst examine to determine the volume serial number and the drive letter assigned to the USB device? (Choose two.)

Question 33hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system that may have been compromised via a malicious USB device. The analyst wants to determine the volume serial number and the last time a USB mass storage device was connected. Which registry key should the analyst examine to find this information?

Question 34mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When analyzing the 'TypedPaths' registry key, what type of user activity is being reviewed?

Question 35mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a file on a system that appears to be a 'hidden' executable. Which attribute of the NTFS file system, if modified, is a common indicator of a user attempting to conceal a file from standard Explorer views?

Question 36mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which artifact is the most reliable for determining if an external USB mass storage device was mounted on a system, even if the device is no longer present?

Question 37mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which registry hive contains the 'UserAssist' key, and what is its primary forensic value?

Question 38mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst discovers a suspicious executable in the C:\Users\Public folder. To determine if the file was executed, the analyst examines the Shimcache. Which behavior is characteristic of the Shimcache artifact?

Question 39hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is analyzing the Windows Event Logs and finds Event ID 4697. What is the primary significance of this event in the context of forensic analysis?

Question 40mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When reviewing Jump Lists on a Windows system, which file extension is commonly associated with the 'AutomaticDestinations' folder?

Question 41mediummultiple choice

Read the full Windows Artifact Analysis explanation →

What is the primary function of the ShellBags artifact in a Windows forensic investigation?

Question 42mediummultiple choice

Read the full Windows Artifact Analysis explanation →

When analyzing the Windows Registry, what is the primary purpose of the 'SAM' hive?

Question 43mediummultiple choice

Read the full Windows Artifact Analysis explanation →

Which of the following describes the correct function of the $MFT (Master File Table) in an NTFS-formatted Windows volume?

Question 44mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During an intrusion investigation, an analyst needs to determine the exact moment a malicious service was installed on a Windows 10 host. The attacker deleted the service's executable and cleared the System event log. Which artifact should the analyst examine to recover the service installation timestamp?

Question 45mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a compromise investigation, an analyst reviews Windows Event Logs and observes that Security Event ID 4688 entries are present, but the Process Command Line field is empty for all of them. The system is running Windows 10 Enterprise. What is the most likely reason for the missing command line data?

Question 46mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 workstation that is suspected of having a malicious service installed for persistence. The analyst wants to determine the original path of the service executable and the account it runs under. Which registry location should the analyst examine to find this information?

Question 47mediummultiple choice

Read the full Windows Artifact Analysis explanation →

During a forensic examination of a Windows 10 workstation, an analyst needs to determine which user account was interactively logged on at a specific date and time. The system is powered off and only the disk image is available. Which artifact should the analyst examine to find the most reliable record of interactive logon sessions, including logon type and timestamp?

Question 48mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is reviewing a Windows 10 endpoint and finds that a scheduled task was created to run a PowerShell script at logon. The task was likely created by an attacker to maintain persistence. Which artifact should the analyst examine to determine the exact time the task was registered and the user account that created it?

Question 49mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 host and finds that a suspicious process was launched shortly after a user logged on. To determine the exact time the process was created and capture its parent-child relationship, which artifact should the analyst prioritize?

Question 50hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is analyzing a Windows 10 system where an attacker allegedly used a PowerShell script to download and execute a malicious payload. The investigator wants to determine the exact PowerShell commands that were executed. Which Windows artifact should the investigator examine to find this information?

Question 51easymultiple choice

Read the full Windows Artifact Analysis explanation →

A forensic analyst is examining a Windows 10 system and wants to determine which USB storage devices have been connected to the machine. The analyst has access to the registry. Which registry key should the analyst examine to find a list of USB devices that have been connected, including vendor and product IDs?

Question 52mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system to determine if a specific USB device was connected. The analyst has already checked the registry and found no trace in USBSTOR. Which TWO additional artifacts should the analyst examine to corroborate USB device connection? (Choose two.)

Question 53hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and discovers that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. What is the primary forensic significance of this artifact?

Question 54easymultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is reviewing a Windows 10 system and wants to determine the last time a user accessed a specific file. The analyst examines the file's NTFS standard information attributes and finds that the last access time is not updated. What is the most likely reason for this?

Question 55mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system and finds a suspicious shortcut file in a user's Recent folder. The analyst wants to determine the full path of the target file and any command-line arguments used when the shortcut was created. Which artifact should the analyst examine?

Question 56mediummulti select

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to remotely execute commands on the system. Which TWO artifacts should the analyst examine to corroborate this activity? (Choose two.)

Question 57hardmulti select

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system to determine if a specific user account was used to access files on a remote share. Which two artifacts would provide the most direct evidence of this activity? (Choose two.)

Question 58easymultiple choice

Read the full Windows Artifact Analysis explanation →

An investigator is examining a Windows 10 system and finds a prefetch file named 'POWERSHELL.EXE-12345678.pf' in the C:\Windows\Prefetch folder. What is the primary forensic value of this artifact?

Question 59mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is investigating a Windows 10 system where an attacker allegedly used a remote access tool (RAT) that persists by modifying the Image File Execution Options (IFEO) registry key. The analyst wants to identify which executable was hijacked. Which registry location should the analyst examine to find the Debugger value that redirects execution?

Question 60mediummultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?

Question 61hardmultiple choice

Read the full Windows Artifact Analysis explanation →

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable. The analyst wants to determine whether the executable was actually executed on the system. Which additional artifact should the analyst examine to confirm execution?