GCFA Practice Question: Identification of Malicious and Normal Activity
An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)
⚠ Common exam trap
The trap here is focusing on process creation or logon events, which are indirect, instead of the direct memory access and dump file artifacts that prove LSASS was targeted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.
Sysmon ProcessAccess events targeting lsass.exe with access masks like 0x1010 or 0x1410 directly show attempts to read LSASS memory, which is central to credential dumping. Similarly, an lsass.dmp file created in a user-writable directory with a corresponding file creation event provides concrete evidence of memory dumping. Both artifacts are high-fidelity indicators of credential theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Security event ID 4672 indicating special privileges assigned to a new logon for a service account.
Why it's wrong here
Event ID 4672 logs special privileges assigned to a logon, which is common for service accounts and administrative logons. It does not indicate LSASS memory access. This event is not specific to credential dumping and would produce many false positives in a domain controller environment.
- ✓
Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.
Why this is correct
Sysmon event ID 10 logs process access events. When the target is lsass.exe and the granted access mask includes rights like PROCESS_VM_READ and PROCESS_QUERY_INFORMATION (commonly 0x1010 or 0x1410), it strongly indicates an attempt to read LSASS memory, which is a hallmark of credential dumping tools such as Mimikatz.
- ✗
Windows Security event ID 4688 with process creation for a known credential dumping tool, including its command line.
Why it's wrong here
Event ID 4688 logs process creation and can show a credential dumping tool being executed, but it does not directly prove that LSASS memory was accessed. The tool might have failed or targeted other processes. It is an indicator of potential intent, but not direct evidence of LSASS memory access.
- ✓
Presence of a memory dump file named lsass.dmp in a user-writable directory, with a corresponding Sysmon event ID 11 (FileCreate).
Why this is correct
A file named lsass.dmp in a user-writable directory is a strong indicator of credential dumping, as tools like ProcDump or Task Manager can create such a dump. The corresponding Sysmon event ID 11 (FileCreate) confirms the file creation. This directly shows LSASS memory was dumped for later credential extraction.
- ✗
Windows Security event ID 4624 logon type 3 (network) from a workstation to the domain controller.
Why it's wrong here
Event ID 4624 with logon type 3 indicates a network logon, which is normal in domain environments. It does not provide evidence of LSASS memory access. While it could be part of lateral movement, it is not direct evidence of credential dumping from LSASS.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.