GCFA Windows Artifact Analysis Practice Test 4 — 15 Questions

Question 1

An analyst is examining a Windows 10 workstation that is suspected of having a malicious service installed for persistence. The analyst wants to determine the original path of the service executable and the account it runs under. Which registry location should the analyst examine to find this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. The Services registry key stores configuration data for every Windows service, including the ImagePath value that points to the executable and the ObjectName value that specifies the account. Examining this key allows the analyst to identify the malicious service's original path and the security context it uses, which is critical for understanding persistence and privilege level.

Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

Question 2

During a forensic examination of a Windows 10 workstation, an analyst needs to determine which user account was interactively logged on at a specific date and time. The system is powered off and only the disk image is available. Which artifact should the analyst examine to find the most reliable record of interactive logon sessions, including logon type and timestamp?

Accepted Answer

Security event log, filtering for Event ID 4624 with Logon Type 2 or 10. Security event log entries with Event ID 4624 and Logon Type 2 or 10 provide definitive records of interactive and RemoteInteractive logons, including the account name, timestamp, and logon type. Other artifacts like shell bags, SRUM, or Prefetch may show user activity but lack the direct logon session details required to answer who was logged on and when.

Answer

Prefetch files, checking the last execution time of explorer.exe

Answer

NTUSER.DAT registry hive, examining the LastWrite time of the user's shell bags

Answer

SRUM database, querying the Network Usage table for active connections

Question 3

An analyst is reviewing a Windows 10 endpoint and finds that a scheduled task was created to run a PowerShell script at logon. The task was likely created by an attacker to maintain persistence. Which artifact should the analyst examine to determine the exact time the task was registered and the user account that created it?

Accepted Answer

The Security event log, filtering for event ID 4698. Security event ID 4698 is the definitive artifact for scheduled task creation because it captures the task name, the creating user, and the timestamp. Other artifacts like the Task Scheduler operational log or registry keys may show the task exists or when it ran, but they do not reliably provide both the creator identity and the exact creation time, which are critical for attribution in an intrusion investigation.

Answer

The Task Scheduler operational event log (Microsoft-Windows-TaskScheduler/Operational.evtx)

Answer

The registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache

Answer

The Task Scheduler operational log, filtering for event ID 106

Question 4

An analyst is examining a Windows 10 host and finds that a suspicious process was launched shortly after a user logged on. To determine the exact time the process was created and capture its parent-child relationship, which artifact should the analyst prioritize?

Accepted Answer

Sysmon Event ID 1 (Process Creation) in the Windows Event Log. Sysmon Event ID 1 provides the most granular and reliable data for process creation, including exact timestamps and parent-child relationships. Other artifacts like Prefetch, Amcache, and UserAssist offer execution evidence but lack the precision and relationship details needed to reconstruct the sequence of events accurately.

Answer

Prefetch files in C:\Windows\Prefetch

Answer

UserAssist registry keys

Answer

Amcache.hve registry hive

Question 5

An investigator is analyzing a Windows 10 system where an attacker allegedly used a PowerShell script to download and execute a malicious payload. The investigator wants to determine the exact PowerShell commands that were executed. Which Windows artifact should the investigator examine to find this information?

Accepted Answer

PowerShell Operational Event Log. PowerShell Operational logging, when script block logging is enabled, captures the full content of scripts and commands executed, including those run by attackers. This makes it the most reliable artifact for reconstructing the exact PowerShell activity. Other artifacts like Prefetch or Security logs may show that PowerShell ran but not what it executed.

Answer

Windows Security Event Log

Answer

ConsoleHost_history.txt file

Answer

Prefetch files for PowerShell.exe

Question 6

A forensic analyst is examining a Windows 10 system and wants to determine which USB storage devices have been connected to the machine. The analyst has access to the registry. Which registry key should the analyst examine to find a list of USB devices that have been connected, including vendor and product IDs?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum is the authoritative location for USB mass storage device connection history. It records the vendor, product, and revision of each device, along with a serial number when available. Other USB-related keys either include non-storage devices or lack the detailed storage-specific information needed to identify connected USB drives.

Answer

HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Enum

Question 7

An analyst is examining a Windows 10 system to determine if a specific USB device was connected. The analyst has already checked the registry and found no trace in USBSTOR. Which TWO additional artifacts should the analyst examine to corroborate USB device connection? (Choose two.)

Accepted Answer

Setupapi.dev.log. Setupapi.dev.log and the Microsoft-Windows-DriverFrameworks-UserMode/Operational event log both record USB device installation and connection events with timestamps and device identifiers. These artifacts can provide evidence of a USB device even if the USBSTOR registry key has been cleared, making them essential for corroboration.

Answer

Prefetch files for USBSTOR.SYS

Answer

Registry key: HKLM\SYSTEM\CurrentControlSet\Enum\USB

Answer

NTFS $MFT

Question 8

An analyst is investigating a Windows 10 system and discovers that a user's NTUSER.DAT registry hive contains a key named 'RecentDocs' with numerous entries. What is the primary forensic significance of this artifact?

Accepted Answer

It maintains a list of recently accessed files and folders, which can indicate user browsing activity and potential data exfiltration.. RecentDocs provides a list of recently accessed files and folders, which is valuable for understanding user activity and potential data exfiltration. It does not include hashes, execution times, or last access timestamps, so the correct interpretation is that it indicates browsing activity and accessed documents.

Answer

It stores the complete file path and SHA-256 hash of every document opened by the user.

Answer

It records the most recently opened documents and folders, including the last access time and the application used to open them.

Answer

It tracks the execution time of applications associated with the opened documents.

Question 9

An analyst is reviewing a Windows 10 system and wants to determine the last time a user accessed a specific file. The analyst examines the file's NTFS standard information attributes and finds that the last access time is not updated. What is the most likely reason for this?

Accepted Answer

NTFS last access time updates are disabled by default.. By default, Windows disables last access time updates to reduce disk I/O. The registry value NtfsDisableLastAccessUpdate controls this, and it is set to 1 on most modern systems. As a result, the last access time may not reflect recent file accesses, making it unreliable for forensic purposes unless the setting has been changed.

Answer

The file has the 'N' attribute set.

Answer

The file system is mounted as read-only.

Answer

The file is on a network share.

Question 10

An analyst is investigating a Windows 10 system and finds a suspicious shortcut file in a user's Recent folder. The analyst wants to determine the full path of the target file and any command-line arguments used when the shortcut was created. Which artifact should the analyst examine?

Accepted Answer

The .lnk file itself. Shortcut (.lnk) files contain embedded structures that include the target path, working directory, command-line arguments, and other metadata. Parsing these files directly provides the most accurate and detailed information about the shortcut's target, which is essential for understanding what the shortcut would execute.

Answer

The Windows Registry key: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

The Prefetch file for explorer.exe

Answer

The jumplist AutomaticDestinations file

Question 11

An analyst is investigating a Windows 10 system for evidence of lateral movement. The analyst suspects that an attacker used PsExec to remotely execute commands on the system. Which TWO artifacts should the analyst examine to corroborate this activity? (Choose two.)

Accepted Answer

System event log for Event ID 7045 (service installation). PsExec usage on a target system leaves two key artifacts: the installation of the PSEXESVC service, recorded in the System event log as Event ID 7045, and the execution of PSEXESVC.exe, which generates a Prefetch file. These directly indicate PsExec activity. Other artifacts like network logons or Amcache entries are less specific and may be caused by other activities.

Answer

Amcache.hve for entries related to PsExec.exe

Answer

SRUM database for network connections by PsExec.exe

Answer

Security event log for Event ID 4624 with Logon Type 3

Question 12

An analyst is examining a Windows 10 system to determine if a specific user account was used to access files on a remote share. Which two artifacts would provide the most direct evidence of this activity? (Choose two.)

Accepted Answer

Security Event ID 4624 with Logon Type 3. Security Event ID 4624 with Logon Type 3 and Event ID 5140 both directly record network logons and share access, respectively. They provide the account, timestamp, and share details needed to prove a user accessed a remote share. The other artifacts lack the specificity to directly evidence this activity.

Answer

UserAssist registry keys

Answer

Prefetch files for the remote access client

Answer

Sysmon Event ID 3 (Network Connection)

Question 13

An investigator is examining a Windows 10 system and finds a prefetch file named 'POWERSHELL.EXE-12345678.pf' in the C:\Windows\Prefetch folder. What is the primary forensic value of this artifact?

Accepted Answer

It confirms that PowerShell was executed and provides the last execution time and number of times run.. The correct answer is that the prefetch file confirms execution and provides last execution time and run count. Prefetch files are created by the Windows Prefetcher to optimize application startup, and they include metadata such as the last run time and number of executions. This makes them a key artifact for determining if an executable like PowerShell was run, and when.

Answer

It contains the full command-line arguments used when PowerShell was launched.

Answer

It indicates that PowerShell was installed as a service on the system.

Answer

It provides a list of all files accessed by PowerShell during its execution.

Question 14

An analyst is investigating a Windows 10 system where an attacker allegedly used a remote access tool (RAT) that persists by modifying the Image File Execution Options (IFEO) registry key. The analyst wants to identify which executable was hijacked. Which registry location should the analyst examine to find the Debugger value that redirects execution?

Accepted Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. IFEO hijacking involves creating a subkey under Image File Execution Options named after a legitimate executable and setting a Debugger value to a malicious program. This causes Windows to launch the debugger instead of the intended executable. The correct registry path is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. Other options are unrelated persistence or forensic artifacts.

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts

Answer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Question 15

An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?

Accepted Answer

$I file. In Windows 10, each deleted file in the Recycle Bin has a corresponding $I file that stores the original path, deletion time, and file size. The $R file contains the actual data. The $Recycle.Bin folder is the container, and INFO2 is obsolete. Therefore, the $I file is the correct artifact to examine.

Answer

INFO2 file

Answer

$Recycle.Bin folder

Answer

$R file