GCFA Windows Artifact Analysis Practice Test 2 — 15 Questions

Question 1

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Security event log Event ID 4688 with command-line auditing enabled. To recover both command-line arguments and script block content, the analyst needs Security Event ID 4688 with command-line auditing for the arguments, and PowerShell Operational Event ID 4104 for the script block content. These two artifacts together provide the full picture of what was executed. Other logs may offer partial information but do not cover both aspects as directly.

Answer

Sysmon Event ID 1 (Process Creation)

Answer

PowerShell ConsoleHost_history.txt file

Answer

PowerShell Operational log Event ID 4103

Question 2

An analyst is examining a Windows 10 workstation that is suspected of being used to exfiltrate data via a user-installed cloud-sync client. The analyst wants to correlate the exact times when files were added to a synced folder with network activity. Which Windows artifact should the analyst examine first to obtain the most direct record of individual file operations performed by that application?

Accepted Answer

The Microsoft-Windows-CloudFiles Operational event log. The Cloud Files Operational log is generated by the cloud-sync service and captures file-level operations such as hydration and dehydration. Because it attributes each operation to the sync engine, it directly supports correlating file additions with the client's network activity. The USN journal lacks process attribution, the $MFT lacks operation detail, and Prefetch only shows execution, not file-level actions.

Answer

The NTFS $UsnJrnl:$J alternate data stream

Answer

The $MFT record for the synced folder

Answer

The Prefetch file for the cloud-sync client executable

Question 3

An analyst is examining a Windows 10 system for evidence of a file that was recently deleted. The analyst suspects the file was removed using a command-line tool. Which artifact should be examined to determine the original path and deletion time of the file, assuming the file was deleted from an NTFS volume?

Accepted Answer

$MFT and $UsnJrnl:$J. The correct answer combines the $MFT and $UsnJrnl:$J. The $MFT provides the file record, including parent directory references and timestamps, while the $UsnJrnl:$J logs the deletion event with a timestamp. When correlated, they can reveal the original path and deletion time. This approach is standard for NTFS forensic analysis, especially when the Recycle Bin is bypassed.

Answer

$MFT and $LogFile

Answer

$Recycle.Bin and $I files

Answer

$UsnJrnl:$J

Question 4

An analyst is examining a Windows 10 system suspected of being compromised. The analyst finds that the file `C:\Windows\System32\winevt\Logs\Security.evtx` has been deleted. A quick check of the volume shadow copies shows no recent copies. Which artifact should the analyst examine next to determine if the Security event log was cleared, and to recover potentially relevant event records?

Accepted Answer

The Windows Event Log's 'Event ID 1102' in the Security log, if the log was cleared before deletion. Event ID 1102 in the Security log is the definitive indicator that the Security audit log was cleared. Even if the log file is deleted, the analyst should attempt to recover it or look for forwarded copies. Other options incorrectly attribute log clearing events to the System log or suggest NTFS metadata that does not contain event log data.

Answer

The Windows Event Log service's 'Event ID 1102' in the System log

Answer

The 'Event ID 104' in the System log indicating log clearing

Answer

The $LogFile metadata file in the NTFS volume

Question 5

An analyst is examining a Windows 10 system and wants to determine which user account was used to run a specific program that left a prefetch file. The prefetch file is named NOTEPAD.EXE-1A2B3C4D.pf. Which artifact should the analyst examine to correlate the prefetch execution with a user account?

Accepted Answer

Security event log Event ID 4688 with user account information. Security Event ID 4688 records process creation with the user account SID, allowing direct correlation with a prefetch file's execution timestamp and process name. This event is the most reliable artifact for attributing a specific program execution to a user account. Other artifacts like UserAssist or SRUM may indicate user activity but do not provide the same direct linkage to a specific prefetch file.

Answer

Amcache.hve

Answer

UserAssist registry key

Answer

SRUM database

Question 6

An analyst is investigating a compromised Windows Server 2019 domain controller. The attacker reportedly used a PowerShell script to create a scheduled task that runs a malicious binary. The analyst has recovered the Task Scheduler operational log and the XML task definition. Which artifact should the analyst examine to determine the exact user account that registered the task, including the security identifier (SID)?

Accepted Answer

The Task Scheduler operational log, Event ID 106 with the UserContext field. The Task Scheduler operational log Event ID 106 records task registration and includes a UserContext field containing the SID of the registering user. This is the most direct artifact to attribute task creation to a specific account. The XML task definition shows configuration, not the creator, and Security Event ID 4698 may not be enabled. Therefore, the operational log with UserContext is the correct source.

Answer

The XML task definition stored in C:\Windows\System32\Tasks

Answer

The Security event log, Event ID 4698

Answer

The Task Scheduler operational log, Event ID 106

Question 7

An investigator is examining a Windows 10 system and needs to determine which user account was used to run a specific program. The program was executed via a shortcut on the desktop, and the investigator has access to the user's NTUSER.DAT hive. Which registry key should be examined to find the most recently accessed programs via the Run dialog or Windows Explorer?

Accepted Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count. UserAssist is the primary artifact for tracking user-initiated program execution via Explorer, including shortcuts. It records the execution count and last execution time in a ROT13-encoded format. The other keys track different activities: RunMRU for Run dialog commands, RecentDocs for recently opened documents, and OpenSavePidlMRU for file dialog usage. Only UserAssist directly answers which user ran the program.

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Question 8

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft-Windows-TaskScheduler/Operational log. The correct answers are the TaskScheduler Operational log and the Security Auditing log with Event ID 5145. The TaskScheduler log directly records task registration and execution events, while Event ID 5145 captures SMB share access that often accompanies remote task creation. Together, they provide evidence of remote scheduled task activity. Other logs are less specific to scheduled tasks.

Answer

Microsoft-Windows-WMI-Activity/Operational log

Answer

Microsoft-Windows-PowerShell/Operational log

Answer

Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational log

Question 9

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The UserAssist key in NTUSER.DAT. The UserAssist key in NTUSER.DAT records GUI application executions with timestamps and run counts, and often includes the full path of the executable. When analyzed alongside RecentDocs, which lists recently opened files, UserAssist can help determine which application was used to open those files. Shellbags, Jump Lists, and MUICache serve different purposes and do not provide the application-file correlation needed here.

Answer

The Shellbags registry keys

Answer

The MUICache key in NTUSER.DAT

Answer

The Jump Lists automatic destinations files

Question 10

During a forensic examination of a Windows 10 system, an analyst notices that the Windows Event Log service is not running, and many event log files are missing. Which artifact can still provide evidence of historical system events and application execution?

Accepted Answer

Windows Event Log files (.evtx) that may still exist in C:\Windows\System32\winevt\Logs. The .evtx files in the winevt\Logs directory persist even if the Event Log service is stopped or missing. They can be parsed offline to recover historical system events, making them the best available artifact when the service is not running. Other artifacts like Prefetch and SRUM have narrower scopes and do not capture the full range of system events.

Answer

Prefetch files

Answer

Registry transaction logs (.LOG files)

Answer

SRUM (System Resource Usage Monitor) database

Question 11

An analyst is examining a Windows 10 system and wants to determine the last time a specific USB storage device was connected to the system. The analyst has the device's serial number. Which registry artifact should the analyst examine to find this information?

Accepted Answer

SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR key under SYSTEM\CurrentControlSet\Enum records USB mass storage devices by serial number and includes subkeys with timestamps indicating first and last connection. This is the most reliable registry artifact for determining when a specific USB device was last connected to the system.

Answer

SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt

Answer

SYSTEM\CurrentControlSet\Services\USBSTOR\Enum

Answer

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Question 12

An analyst is examining a Windows 10 system that was compromised via a malicious macro in a Microsoft Word document. The analyst wants to determine the original source of the document, such as whether it was downloaded from the internet or received via email. Which Windows artifact should the analyst examine to find the Zone.Identifier alternate data stream?

Accepted Answer

The file's Zone.Identifier alternate data stream. The Zone.Identifier alternate data stream is created by Windows when a file is downloaded from the internet or saved from an email attachment. It contains the zone ID and sometimes the referrer URL, directly indicating the file's origin. Other NTFS attributes like $STANDARD_INFORMATION, $FILE_NAME, and $OBJECT_ID do not store this information. Thus, the analyst should examine the Zone.Identifier stream.

Answer

The file's $STANDARD_INFORMATION attribute

Answer

The file's Object ID in the $OBJECT_ID index

Answer

The file's $FILE_NAME attribute

Question 13

An analyst is investigating a Windows 10 system where an attacker used PowerShell to download and execute a malicious script. The analyst wants to determine the PowerShell command-line arguments and script block content that were executed. Which TWO artifacts should the analyst examine to recover this information? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Event ID 7045. Event ID 4697 (Security log) and Event ID 7045 (System log) both record service installation. PsExec installs PSEXESVC on the target, so these events will show that installation. Event 4624 is too generic, 4688 requires extra auditing and is not specific, and 5140 logs share access, which may occur but is not the direct indicator of PsExec service installation.

Answer

Event ID 5140

Answer

Event ID 4624

Answer

Event ID 4688

Question 14

An analyst is examining a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to execute commands on remote systems. Which TWO artifacts should the analyst examine to confirm PsExec execution on the target system? (Choose two.)

Accepted Answer

The presence of a service named 'PSEXESVC' in the registry. PsExec execution on a target system leaves two primary artifacts: the installation of the PSEXESVC service, which can be found in the registry under the Services key, and the corresponding System event log entry with event ID 7045. These directly indicate that PsExec was used. Other artifacts like Amcache, Security event 4688, or Prefetch may be inconsistent or refer to the attacker's system rather than the target.

Answer

The Prefetch file PSEXESVC.EXE-*.pf

Answer

The Security event log for event ID 4688 with process name psexec.exe

Answer

The Amcache.hve file for entries related to psexec.exe

Question 15

An analyst is examining a Windows 10 system and finds that the ShimCache (AppCompatCache) contains an entry for a malicious executable, but the entry lacks a timestamp. What is the most likely reason for the missing timestamp?

Accepted Answer

The executable was executed but the ShimCache entry was created without a timestamp due to Windows version differences.. The correct answer is that Windows 10 ShimCache entries often lack timestamps due to version-specific behavior. Unlike older Windows versions, Windows 10 does not consistently store timestamps in the AppCompatCache. The presence of an entry indicates the file was seen by the system, but it does not definitively prove execution. Analysts must correlate with other artifacts like prefetch or event logs.

Answer

The ShimCache entry was created by a different user account, and timestamps are only stored for the system account.

Answer

The executable was never executed; the ShimCache entry only proves the file existed on disk.

Answer

The ShimCache entry was manually injected by an attacker to mislead the investigation.