GCFA Practice Questions

Question 1

An enterprise incident response team is handling a breach where the adversary used valid credentials to access a cloud-hosted email service and created a mailbox forwarding rule to exfiltrate messages. The team has identified the compromised account and wants to determine the full scope of mailbox access and rule creation across the tenant. Which single action should the responder take to obtain the authoritative audit record of these activities?

Accepted Answer

Export the Unified Audit Log from the Microsoft 365 compliance center and filter for mailbox rule and access events. The Unified Audit Log is the authoritative tenant-wide record for mailbox access and rule creation in Microsoft 365. It captures events like New-InboxRule and MailItemsAccessed, allowing the responder to determine the full scope of adversary activity. Message trace, client logs, and Microsoft Entra ID sign-in logs provide complementary but incomplete views and do not record the mailbox-level actions needed.

Answer

Run a message trace in the Exchange admin center for the past 30 days

Answer

Inspect the Microsoft Entra ID sign-in logs for the compromised account

Answer

Review the mailbox owner's Outlook client logs on their workstation

Question 2

An analyst is examining the USN Journal. What is the primary purpose of this file in the context of NTFS forensic analysis?

Accepted Answer

Providing a history of file system changes.. The USN Journal ($UsnJrnl) provides a chronological log of all changes made to files and directories on an NTFS volume. For forensics, it is invaluable because it captures activity that may no longer be reflected in the current MFT, such as the creation and subsequent deletion of files, or directory renames, providing a persistent history of disk modifications for timeline reconstruction.

Answer

Storing encrypted file passwords.

Answer

Maintaining the B-tree structure of directories.

Answer

Tracking user login and logout sessions.

Question 3

An analyst is investigating a suspected credential dumping incident on a Windows Server 2016 domain controller. The analyst has acquired a memory image and the Windows event logs. Which TWO of the following artifacts would provide the most direct evidence that LSASS memory was accessed for credential theft? (Choose two.)

Accepted Answer

Sysmon event ID 10 (ProcessAccess) where the target process is lsass.exe and the granted access includes 0x1010 or 0x1410.. Sysmon ProcessAccess events targeting lsass.exe with access masks like 0x1010 or 0x1410 directly show attempts to read LSASS memory, which is central to credential dumping. Similarly, an lsass.dmp file created in a user-writable directory with a corresponding file creation event provides concrete evidence of memory dumping. Both artifacts are high-fidelity indicators of credential theft.

Answer

Windows Security event ID 4672 indicating special privileges assigned to a new logon for a service account.

Answer

Windows Security event ID 4688 with process creation for a known credential dumping tool, including its command line.

Answer

Windows Security event ID 4624 logon type 3 (network) from a workstation to the domain controller.

Question 4

When creating a super-timeline using tools like log2timeline, why is it critical to filter the output data?

Accepted Answer

Filtering isolates relevant events from the massive volume of benign system activity. Super-timelines ingest massive amounts of data from diverse sources, including system logs, web history, and file system metadata. Without filtering, the volume of 'noise' from routine system activity makes it nearly impossible to isolate the specific events relevant to an incident. Filtering allows the investigator to focus on anomalous patterns and specific time windows, drastically increasing the efficiency and accuracy of the forensic reconstruction process during a high-pressure investigation.

Answer

Filtering increases the precision of the file system's internal clock

Answer

Filtering removes redundant entries to prevent system crashes during analysis

Answer

Filtering is required to encrypt the timeline output for secure storage

Question 5

An analyst reviewing Windows event logs on a compromised workstation discovers a sudden spike in Event ID 4624 with Logon Type 3, followed immediately by Event ID 4672. The source IP address belongs to a non-routable internal subnet. Which forensic interpretation best explains this activity?

Accepted Answer

An adversary performed lateral movement using stolen administrative credentials over the network to access administrative shares.. This specific sequence indicates a network logon successfully authenticating an administrative user, frequently observed during lateral movement via SMB or PsExec. Understanding this pattern allows analysts to differentiate authorized administrative maintenance from credential-based attacks, mapping directly to attacker tactics in enterprise environments.

Answer

An interactive user logged into the local console, triggering default privilege escalation assignments.

Answer

A scheduled batch job executed locally using stored credentials without generating network authentication traffic.

Answer

A service account automatically restarted following a system crash, initiating local service control manager requests.

Question 6

An investigator is analyzing ext4 file system timelines extracted via fls and mactime. They notice that an inode's ctime was updated recently, but the atime and mtime remained unchanged. What does this specific combination of inode timestamp changes typically indicate in a Linux environment?

Accepted Answer

The file permissions, ownership, or extended attributes were altered without modifying the underlying data blocks.. In ext4 file systems, the inode change time (ctime) updates whenever the inode metadata is modified, even if the file content (mtime) or access time (atime) remains untouched. Recognizing that metadata-only operations like permission changes or ownership transfers update ctime independently is critical for distinguishing between content tampering and permission hardening.

Answer

The file contents were modified via a redirected write operation from a standard unprivileged user shell script.

Answer

A background process read the file contents while the file system was mounted with strictatime options enabled.

Answer

The file was accessed and executed in memory using a shared library mapping that suppressed standard kernel logging.

Question 7

Based on the process metadata provided in the exhibit, what is the most significant indicator that requires further investigation?

Accepted Answer

The ParentPID value. The process name 'svchost.exe' is a common target for masquerading. While the path seems correct, the Parent Process ID (PPID) is the critical indicator. A legitimate svchost.exe should always be spawned by 'services.exe'. If the PPID 567 points to an unexpected process, such as an explorer.exe or a temporary file, it indicates a potential process masquerading or injection attempt, warranting immediate deep-dive analysis of that parent process.

Answer

The command line contains -k netsvcs

Answer

The process path is C:\Windows\System32\

Answer

The process name is svchost.exe

Question 8

An analyst discovers a file on a system that appears to be a 'hidden' executable. Which attribute of the NTFS file system, if modified, is a common indicator of a user attempting to conceal a file from standard Explorer views?

Accepted Answer

File Attribute Flags (MFT). NTFS file attributes allow users to hide files from the standard Windows Explorer interface. By checking the File Attributes field in the Master File Table (MFT), an analyst can identify files marked with the 'Hidden' or 'System' attribute. This is a common, albeit simple, anti-forensics technique used by adversaries to prevent casual discovery of malicious binaries or staged data, and it is the first step in identifying deliberate concealment attempts.

Answer

File Creation Timestamp

Answer

Extended Attributes (EA)

Answer

Access Control List (ACL)

Question 9

Which THREE items are critical to inspect when analyzing a memory dump for evidence of Process Hollowing or Injection?

Accepted Answer

Memory Page Permissions (RWX). Process injection techniques often modify memory protections or inject code into existing legitimate processes. By comparing the disk-based image of a process with its memory-based representation, analysts can identify discrepancies in executable sections. Checking memory protections (e.g., RWX permissions) and identifying unbacked executable code in private memory regions are the primary methods for uncovering sophisticated persistent threats that operate entirely within the volatile memory space.

Answer

The system's Event Log files

Answer

The MFT file records

Question 10

When analyzing a memory capture, you notice a process has a 'hidden' network connection. Which artifact provides the best view of active network connections linked to specific process IDs?

Accepted Answer

TCP Endpoint structures. The TCP Endpoint structures in kernel memory are essential for mapping network activity to process ownership. Attackers often attempt to hide connections using rootkit techniques, but these structures in memory usually remain accurate. Linking a specific PID to a remote IP address allows the analyst to identify Command and Control (C2) communication, which is the most reliable way to identify an active, compromised host during a live incident response.

Answer

DNS cache

Answer

Shimcache

Answer

Amcache.hve

Question 11

An analyst is building a file system timeline from an NTFS volume and is deciding which timestamps to extract from the $STANDARD_INFORMATION attribute. A colleague suggests that the four timestamps in $STANDARD_INFORMATION are the only relevant times. Which statement correctly describes the relationship between $STANDARD_INFORMATION and $FILE_NAME timestamps?

Accepted Answer

$STANDARD_INFORMATION and $FILE_NAME each contain four timestamps, and comparing them can reveal timestamp manipulation or file moves.. NTFS stores timestamps in both the $STANDARD_INFORMATION and $FILE_NAME attributes of an MFT record. The two sets are maintained by different mechanisms and can disagree, which is itself valuable evidence. An analyst should extract both and compare them rather than relying on a single source, because the discrepancies often indicate moves, renames, or deliberate timestamp alteration.

Answer

$STANDARD_INFORMATION timestamps are always more reliable than $FILE_NAME timestamps and should be used exclusively.

Answer

$FILE_NAME timestamps are only populated when a file is created and never change afterward.

Answer

$FILE_NAME timestamps are duplicates of $STANDARD_INFORMATION and can be ignored.

Question 12

An analyst is investigating a Windows 10 system and wants to determine the last time a specific user logged on interactively. The analyst has access to the Security event log. Which event ID should the analyst examine to find this information?

Accepted Answer

4624. Event ID 4624 is the primary event for successful logons. It contains detailed information including the logon type, which distinguishes interactive (type 2 or 10) from network (type 3) or other logons. By filtering for the specific user account and logon types 2 and 10, the analyst can identify the most recent interactive logon. This is a standard technique in Windows forensic analysis.

Answer

4625

Answer

4647

Answer

4634

Question 13

A forensic analyst is examining a Windows 10 memory image and suspects that a process has injected code into another process. The analyst wants to identify injected code by examining memory regions within the target process. Which two Volatility 3 plugins are most appropriate for detecting and analyzing injected code in memory? (Choose two.)

Accepted Answer

windows.vadinfo. The windows.malfind and windows.vadinfo plugins are both designed to analyze process memory for suspicious regions. malfind identifies and dumps potentially injected code based on memory protection and file backing, while vadinfo provides a detailed view of all VADs, helping analysts spot anomalous memory allocations that may contain injected code.

Answer

windows.dlllist

Answer

windows.ldrmodules

Answer

windows.handles

Question 14

An investigator analyzing an NTFS volume notices that a file's $STANDARD_INFORMATION MACB timestamps significantly differ from its $FILE_NAME timestamps. The $FILE_NAME modification time predates the $STANDARD_INFORMATION modification time. What is the most reliable forensic interpretation of this discrepancy?

Accepted Answer

The file was likely subjected to time-stomping where user-space tools altered the $STANDARD_INFORMATION attributes, leaving the original $FILE_NAME timestamps intact.. Timestamp discrepancies between the $STANDARD_INFORMATION and $FILE_NAME attributes often indicate file manipulation, copying, or time-stomping. Since the $STANDARD_INFORMATION attribute can be easily modified by user-space APIs while the $FILE_NAME attribute is managed directly by the NTFS driver, comparing both provides crucial insight into anti-forensic activities and accurate timeline reconstruction during incident response investigations.

Answer

The file was compressed using NTFS compression, which automatically updates the $STANDARD_INFORMATION modification timestamp while leaving $FILE_NAME untouched.

Answer

An automated defragmentation utility ran on the volume, updating the high-level metadata without altering the underlying filename structure.

Answer

The operating system experienced an unclean shutdown, causing the lazy writer thread to flush $STANDARD_INFORMATION changes out of synchronization with $FILE_NAME.

Question 15

An incident responder is preparing to acquire a forensic image of a running Windows server that is suspected of being compromised. The server hosts a critical database that cannot be taken offline. Which method is most appropriate for acquiring the disk image while minimizing disruption?

Accepted Answer

Use a live acquisition tool like FTK Imager or Magnet ACQUIRE to create a forensic image of the disk while the system is running.. For a running server that cannot be taken offline, live acquisition with a tool like FTK Imager or Magnet ACQUIRE is the best option. These tools create a forensic image of the disk while the system is operational, preserving the data with minimal disruption. However, they should be used in conjunction with volatile data collection to capture memory and network state.

Answer

Use a hardware write blocker and remove the disk to image it on a separate workstation.

Answer

Run the built-in Windows backup utility to create a system image to a network share.

Answer

Use diskpart to create a shadow copy and then copy the volume to an external drive.

GIAC Certified Forensic Analyst GCFA practice test

Three ways to study

Study GCFA by domain

Study GCFA by topic

Introduction to File System Timeline Forensics practice questions

NTFS Artifact Analysis practice questions

File System Timeline Artifact Analysis practice questions

Identification of Malicious and Normal Activity practice questions

Introduction to Memory Forensics practice questions

Analyzing Volatile and Windows Event Artifacts practice questions

Enterprise Environment Incident Response practice questions

Windows Artifact Analysis practice questions

GCFA fundamentals practice questions

GCFA scenario practice questions

GCFA troubleshooting practice questions

GIAC Certified Forensic Analyst practice questions