GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
When investigating a suspected fileless malware infection, you identify an anomaly in the 'PowerShell' Operational log. Which event ID indicates the execution of a base64 encoded command string often used to obfuscate malicious scripts?
⚠ Common exam trap
Candidates frequently confuse Event ID 4104 (Script Block Logging) with Event ID 4103 (Module Logging) or process creation events like 4688 when looking for PowerShell execution patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Event ID 4104
Event ID 4104 records the execution of a script block. Attackers frequently use PowerShell's -EncodedCommand parameter to bypass simple string-based signature detection. By analyzing the content of these logs, specifically looking for long, base64-encoded strings, analysts can decode the hidden payloads and reconstruct the attacker's actions, which is vital for understanding the full scope of a fileless attack that avoids traditional disk-based indicators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Event ID 4100
Why it's wrong here
Event ID 4100 is generally associated with the start of the PowerShell engine, but it does not capture the specific script content or the encoded command strings. It is a status indicator for the engine itself, not a detailed log of the executed commands or scripts.
- ✗
Event ID 4103
Why it's wrong here
Event ID 4103 records the execution of modules, identifying which PowerShell modules were loaded during a session. While it provides context on the environment, it does not record the raw command-line arguments or the contents of encoded script blocks executed by an attacker on the system.
- ✓
Event ID 4104
Why this is correct
Event ID 4104 logs the script block content executed by the PowerShell engine. This is the primary event for forensic analysis of PowerShell activity, as it captures the full script, including base64-encoded commands, allowing analysts to decode and analyze the malicious logic used in fileless attacks.
- ✗
Event ID 400
Why it's wrong here
Event ID 400 marks the beginning of a PowerShell session, similar to a logon event. It logs the start of the host process but does not capture the subsequent execution of individual commands, script blocks, or any encoded payloads that the user might have run during the session.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.