Free GIAC Certified Forensic Analyst GCFA Practice Questions

Question 1

Adam, a malicious hacker has successfully gained unauthorized access to the Linux system of Umbrella Inc. Web server of the company runs on Apache. He has downloaded sensitive documents and database files from the computer.

After performing these malicious tasks, Adam finally runs the following command on the Linux command box before disconnecting. for (( i = 0;i<11;i++ )); do dd if=/dev/random of=/dev/hda && dd if=/dev/zero of=/dev/hda; done

Which of the following actions does Adam want to perform by the above command?

1. Making a bit stream copy of the entire hard disk for later download.
2. Deleting all log files present on the system.
3. Wiping the contents of the hard disk with zeros.
4. Infecting the hard disk with polymorphic virus strings.

Question 2

An analyst runs the Volatility 3 malfind plugin against a memory image from a workstation suspected of hosting injected malware. Which memory region characteristic is the primary condition malfind uses to report a region as possibly containing injected code?

1. A file-backed region mapped from a DLL in System32 with PAGE_EXECUTE_WRITECOPY protection
2. A VAD region whose protection allows both write and execute access
3. Any region containing strings that match a loaded YARA rule
4. A read-only region that has been paged out to the pagefile

Question 3

An analyst parses the MFT entry for C:\Windows\System32\wbemsvc32.dll. $STANDARD_INFORMATION shows a creation time of 2019-12-07 09:10:14, while the $FILE_NAME attribute shows a creation time of 2026-03-03 14:22:09. What is the most likely explanation?

1. The DLL shipped with a 2019 Windows build and was updated in place in 2026
2. The $STANDARD_INFORMATION times were backdated with a timestamp-altering tool after the file arrived in 2026
3. The system clock was set to 2019 at the moment the file was created
4. The $FILE_NAME creation time records the last time the DLL was loaded

Question 4

An analyst builds a file system timeline from an NTFS image with The Sleuth Kit. After running fls with the -m option and saving the output to body.txt, what does the mactime step contribute to the workflow?

1. It carves file content from unallocated clusters so deleted data can be added to the timeline
2. It reads the body file and sorts the time values into a chronological timeline of file activity
3. It computes an MD5 hash of every file and writes it into the first field of each body file line
4. It parses registry hives and event logs directly from the image and merges them with the file system data

Question 5

Malfind reports a private PAGE_EXECUTE_READWRITE region in explorer.exe whose first bytes are 4D 5A (MZ). The region has no mapped file, and dlllist shows no module at that base address. Which explanation best fits these findings?

1. A DLL was loaded normally with LoadLibrary and has not yet been added to the PEB
2. The region is a memory-mapped data file that explorer.exe opened for reading
3. A PE file was written into the process and mapped manually, as in reflective DLL injection
4. Windows compressed the page in memory, which changed its protection to read, write and execute

Question 6

In MFTECmd output, a recently dropped executable shows a $STANDARD_INFORMATION creation time of 2021-06-15 10:00:00.0000000, while almost every other timestamp on the volume has non-zero digits across all seven fractional places. Why is this value worth flagging?

1. NTFS rounds creation times to whole seconds, so the value is simply normal
2. The value proves the file was copied from a FAT-formatted USB drive
3. The value is a placeholder NTFS writes whenever a creation time is unknown
4. NTFS records times in 100-nanosecond units, so an exact whole-second value suggests a time set by a tool rather than by normal file activity

Question 7

An analyst reviewing Sysmon process creation events is building a list of expected parents for core Windows processes. Which parent process is normal for smss.exe?

1. services.exe
2. wininit.exe
3. System, or another instance of smss.exe
4. explorer.exe

Question 8

An examiner wants a body file that covers every file and directory on an NTFS partition image, not just the entries in the root directory. Which fls command produces it?

1. fls -m C: -d ntfs.dd > body.txt
2. fls -l -p ntfs.dd > body.txt
3. fls -m C: -D ntfs.dd > body.txt
4. fls -r -m C: ntfs.dd > body.txt

Question 9

The Volatility 3 hollowprocesses plugin reports that the ImageBaseAddress in the PEB of a running svchost.exe does not match the process SectionBaseAddress. Why is this mismatch treated as a sign of process hollowing?

1. The SectionBaseAddress is stored in the pagefile, so any difference proves the image was swapped to disk
2. The PEB value is set by the kernel and the SectionBaseAddress is set by the process, so the process lied
3. Windows changes the PEB image base every time ASLR rebases a DLL, so a mismatch shows a crash
4. The PEB is writable by code in the process, while the SectionBaseAddress lives in kernel memory, so a mismatch shows user-mode tampering

Question 10

An administrator ran a short-lived script interpreter on a server and it exited ten minutes before memory was captured. The analyst wants to find that process, including its exit time, in the memory image. Which Volatility 3 plugin is most likely to show it?

1. windows.psscan, because it carves EPROCESS structures by pool signature and can find processes that are no longer in the active list
2. windows.pslist, because it keeps exited processes in the active process list until reboot
3. windows.pstree, because it reconstructs terminated processes from their children
4. windows.cmdline, because it records the command lines of exited processes

Question 11

Within ten minutes, an Internet-facing server logs hundreds of 4625 events from one source address. Each event names a different valid domain account, and every event shows Sub Status 0xC000006A. Which activity best fits this pattern?

1. User enumeration with guessed account names that do not exist
2. Password spraying of one or a few common passwords across many accounts
3. Repeated attempts to log on to accounts disabled by an administrator
4. Brute forcing many passwords against a single privileged account

Question 12

Comparing a workstation's registry to a clean build, an analyst finds that the Shell value under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon reads explorer.exe, C:\Users\Public\svc.exe. What is the normal state of this value?

1. It normally lists explorer.exe plus every program in the Startup folder
2. It normally points to userinit.exe, which then launches the shell
3. It normally points only to explorer.exe, so the appended program indicates persistence
4. It normally points to winlogon.exe so that the shell restarts after a crash

Question 13

Examining a raw $MFT record for a deleted tool, an analyst sees header flags of 0x0000 where live files show 0x0001, yet the $STANDARD_INFORMATION, $FILE_NAME and $DATA attributes are still present. What does this mean for the timeline?

1. The record is corrupt and its timestamps must be discarded
2. The record describes a directory, because directories use the value 0x0000
3. The in-use flag was cleared on deletion while the attributes remain, so the tool's names and times are recoverable until the entry is reused
4. The record is part of the $MFTMirr backup and duplicates a live entry

Question 14

A firewall team must permit PowerShell remoting from the incident response jump host to all workstations for live response. Which default ports does PowerShell remoting use for WinRM over HTTP and HTTPS?

1. 135 and 445
2. 80 and 443
3. 8080 and 8443
4. 5985 and 5986

Question 15

An insider is suspected of searching for confidential project names on a Windows workstation. Which key in the user's NTUSER.DAT records keywords the user searched for through Windows search features?

1. Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
2. Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
3. Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
4. Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Question 16

Pslist from a Windows 10 workstation with 16 GB of RAM shows about 70 svchost.exe processes, while a Windows 10 virtual machine with 2 GB of RAM shows about 20. Both run the genuine System32 binary under services.exe. What best explains the difference?

1. The workstation is infected with a worm that clones svchost.exe
2. The virtual machine has a rootkit hiding most of its svchost.exe processes
3. On systems with more than 3.5 GB of RAM, Windows 10 runs most services in their own svchost.exe instead of grouping them
4. Each logged-on user receives a separate copy of every service on high-memory systems

Question 17

In a domain where accounts normally use AES, one user account requests service tickets for 40 different SPNs within two minutes. The domain controller's 4769 events for these requests show Ticket Encryption Type 0x17. Which attack is most likely?

1. Password spraying
2. DCSync
3. Kerberoasting
4. Pass the hash

Question 18

The incident response team has turned the evidence over to the forensic team. Now, it is the time to begin looking for the ways to improve the incident response process for next time.

What are the typical areas for improvement?

Each correct answer represents a complete solution.

Choose all that apply.

1. Information dissemination policy
2. Additional personnel security controls
3. Incident response plan
4. Electronic monitoring statement

Question 19

In a user's NTUSER.DAT, value names under Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count look like P:\Hfref\wqbr\Qbjaybnqf\gbby.rkr. Why do the names appear this way?

1. They are Base64 encoded to fit the REG_BINARY data type.
2. They are encrypted with a key derived from the user's SID.
3. Letters in the names are obfuscated with ROT-13, which can be reversed without a key.
4. They are stored as UTF-16 big-endian strings that the viewer misreads.

Question 20

Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate a compromised system of a cyber criminal, who hides some information in his computer. This computer runs on Linux operating system. Adam wants to extract the data units of a file, which is specified by its meta-data address. He is using the Sleuth Kit for this purpose.

Which of the following commands in the Sleuth kit will he use to accomplish the task?

1. dcat
2. ifind
3. icat
4. istat

Question 21

The Volatility 3 sessions plugin groups processes by session and labels one group with the session type RDP-Tcp#2 and the user CORP/jlee. Where does the plugin obtain the session type and the user name?

1. From Security event 4624 records cached in memory
2. From the SAM hive entry for each logged-on account
3. From each process's environment variables, such as SESSIONNAME, USERNAME and USERDOMAIN
4. From the Remote Desktop Services configuration in the SYSTEM hive

Question 22

A laptop was found hibernated, and its disk was imaged. A raw keyword search of C:\hiberfil.sys finds almost none of the plain-text strings that a RAM capture of a similar running system contains. What is the most likely reason?

1. The hibernation file stores only page tables, not memory contents
2. Hibernation writes memory to pagefile.sys, leaving hiberfil.sys empty
3. The hibernation file is encrypted with the user's logon password
4. Memory is saved to the hibernation file in a compressed format, so it must be decompressed or converted before raw searching

Question 23

An analyst wants Volatility 3 output that reflects the connections and listeners still tracked by the TCP/IP stack's own structures, similar to what netstat would have shown on the live host, rather than objects carved from anywhere in memory. Which plugin fits that goal?

1. windows.netscan
2. windows.handles
3. windows.sessions
4. windows.netstat

Question 24

EDR shows that a payload started from HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce when a user logged on. When the analyst exports that key an hour later, it contains no values. What is the most likely explanation?

1. RunOnce values under HKCU are only read when the user is a member of the Administrators group.
2. Windows moves executed RunOnce values into the corresponding Run key.
3. RunOnce values are ignored unless the computer is started in Safe Mode.
4. By default, Windows deletes a RunOnce value before its command line runs.

Question 25

An analyst moving from Volatility 2 to Volatility 3 looks for the profile list for a Windows 10 memory image and cannot find one. How does Volatility 3 obtain the kernel structure definitions it needs for the image?

1. It uses symbol tables in JSON (ISF) format and, for Windows, can generate a matching table from the kernel PDB downloaded from Microsoft's symbol server
2. It requires the analyst to run imageinfo and then pass the suggested profile with the --profile option
3. It reads the structure layouts from the hiberfil.sys file collected with the memory image
4. It applies one fixed set of structure offsets that covers every Windows 10 build

Question 26

An administrator must connect by RDP to a server suspected of running credential-dumping malware and uses Restricted Admin mode. What is the effect on the administrator's account credentials?

1. They are cached on the server but encrypted with the RDP session key
2. They are not supplied to the server, and the session uses the computer account's credentials
3. The plaintext password is sent to the server but erased at logoff
4. They are copied into the server's Credential Manager vault instead of LSASS

Question 27

A compromised application server will be restored from a backup taken three weeks ago, but the intrusion's start date is still uncertain. According to NIST SP 800-61r3, what should happen before the backup is used?

1. Restore it immediately, because a backup is always older than the compromise
2. Check the backup for indicators of compromise, corruption, and other integrity issues
3. Restore it into an isolated test domain and promote it to production unchanged
4. Restore it and rely on endpoint detection to catch anything it reintroduces

Question 28

During live response on a Windows 11 host, a responder needs netstat output that names the executable involved in creating each connection or listening port. Which netstat option provides this, and what limitation applies to it?

1. -b, which can be time-consuming and fails unless the user has sufficient permissions
2. -o, which shows the executable path but works only for UDP
3. -n, which resolves each connection to its program name
4. -r, which lists the program that owns each route and listening port

Question 29

On a Windows 11 workstation, an analyst notices that a LogonUI.exe process appears each time a user presses Ctrl+Alt+Del, with winlogon.exe as its parent. How should this activity be classified?

1. Suspicious, because credential prompts should come from lsass.exe directly
2. Normal, because Winlogon starts Logon UI after a secure attention sequence to collect credentials
3. Suspicious, because LogonUI.exe should run only once at boot
4. Normal only if LogonUI.exe was started by explorer.exe instead

Question 30

A timeline merges data from a Windows 11 NTFS system volume with a FAT32 USB drive that was last written on a laptop set to UTC+8. Before any adjustment, how do the FAT32 times relate to the NTFS times?

1. FAT32 times reflect the writing computer's local time, so they need the UTC+8 offset applied to align with the UTC-based NTFS times
2. FAT32 times are stored in UTC like NTFS times, so the two sets align without adjustment
3. FAT32 stores no timestamps, so files on the USB drive produce no timeline entries
4. Both file systems store local time, so the same UTC+8 offset must be applied to both sets

Question 31

During live response an analyst considers terminating a process that may be masquerading as a system binary. Which of these processes does Microsoft list as a built-in critical system process whose termination triggers bug check 0xEF?

1. explorer.exe
2. taskhostw.exe
3. spoolsv.exe
4. wininit.exe

Question 32

Process creation auditing is enabled on a Windows 10 fleet, and Security event 4688 records appear for every new process, but the Process Command Line field is always empty. What is the most likely reason?

1. Event 4688 never records command lines; only Sysmon can capture them
2. The policy setting that includes the command line in process creation events has not been enabled, and the field is empty by default
3. The command line is stored only in the Creator Process Name field
4. Command lines are recorded only for processes started by SYSTEM

Question 33

An analyst runs Invoke-Command with -ComputerName listing 500 hosts to collect running process lists and does not specify -ThrottleLimit. How many concurrent remote connections does PowerShell establish for the command?

1. 5
2. 16
3. 32
4. 500, one for every listed host at once

Question 34

Which of the following statements about the HKEY_LOCAL_MACHINE registry hive is true?

1. It contains the user profile for the user who is currently logged on to the computer.
2. It contains information about the local computer system, including hardware and operating system data, such as bus type, system memory, device drivers, and startup control parameters.
3. It contains configuration data for the current hardware profile.
4. It contains data that associates file types with programs and configuration data for COM objects, Visual Basic programs, or other automation.

Question 35

Before exporting a large Plaso storage file, a lead analyst wants to confirm which parsers ran during extraction, how many events each parser produced and what preprocessing recorded about the source system. Which tool provides this?

1. psort.py with the null output module
2. pinfo.py
3. log2timeline.py --info
4. psteal.py with --source pointing at the storage file

Question 36

A super timeline built with Plaso's recycle_bin parser shows an entry from C:\ $Recycle.Bin\S-1-5-21-3623811015-3361044348-30300820-1104\$IZ3K8Q1.zip on a Windows 11 host. What information does this $I file contribute?

1. The deleted file's original size, its deletion date and time, and its original name and location
2. The complete content of the deleted file
3. The name of the process that deleted the file
4. The deleted file's original creation time copied from $STANDARD_INFORMATION

Question 37

Your company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company data.

Which of the following is the most important step for you to take in preserving the chain of custody?

1. Preserve the email server including all logs.
2. Make copies of that employee's email.
3. Seize the employee's PC.
4. Place spyware on the employee's PC to confirm these activities.

Question 38

An analyst has a raw image of a whole Windows 11 disk that holds an EFI system partition, a reserved partition and the main NTFS volume. Before running fls -r -m against the NTFS volume, which step supplies the value that the fls -o option needs?

1. Run mmls on the image and read the starting sector of the NTFS partition from the partition layout
2. Run mactime -h to print the session header, which includes the volume starting sector
3. Run istat on MFT entry 0 to obtain the byte position of the $MFT within the volume
4. Run fls -V to display the default sector offset for the detected image type

Question 39

Volatility 3 cmdline output lists every user-mode process with its arguments, but the entry for the System process (PID 4) shows no command line. What explains this?

1. The System process command line was erased by a rootkit
2. The command line was paged out because the System process had been idle
3. Cmdline skips processes owned by the LocalSystem account
4. The command line is read from the PEB, and the System process has no PEB because it runs only in kernel mode

Question 40

An analyst opens a file from C:\Users\kim\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations in a compound file viewer and sees a stream named DestList plus streams named 1, 2, 3, a, and b. What do the hexadecimal-numbered streams contain?

1. Thumbnail images of recently opened documents
2. Windows Shortcut (LNK) data, one for each item in the Jump List
3. Registry values copied from the RecentDocs key
4. Prefetch data for the application that owns the Jump List

Question 41

An analyst working from an old Volatility 2 cheat sheet wants to list the processes in win11.raw with Volatility 3. Which command uses correct Volatility 3 syntax?

1. python3 vol.py -f win11.raw --profile=Win11x64 pslist
2. python3 vol.py -f win11.raw imageinfo pslist
3. python3 vol.py -f win11.raw windows.pslist
4. python3 vol.py pslist.windows --image win11.raw

Question 42

A USN record for a suspicious write shows only the name payload.dll, a FileReferenceNumber and a ParentFileReferenceNumber. How can the analyst determine the full folder path where payload.dll was written?

1. Read the path from the record's SourceInfo field
2. Resolve the ParentFileReferenceNumber against the $MFT, walking each parent directory up to the root
3. Read the path from the record's SecurityId field
4. Look up the record's USN value in $LogFile, which stores a full path for every USN record

Question 43

A Windows 11 laptop with default power settings was shut down from the Start menu before seizure. Its disk image contains C:\hiberfil.sys. Which memory contents should the analyst expect that file to hold?

1. Kernel and session 0 state, because fast startup logs off user sessions before writing the hibernation file
2. The complete user sessions as they were at shutdown, including open documents
3. Nothing usable, because every shutdown deletes hiberfil.sys
4. Only a copy of the page file made at shutdown

Question 44

The Volatility 3 drivermodule plugin lists a driver object named \Driver\netflt2 whose DriverStart address does not fall inside any kernel module on the loaded module list. What does this most likely indicate?

1. The driver was unloaded normally and its driver object is waiting to be freed
2. The driver is a built-in Windows component that is always reported
3. The driver belongs to a Microsoft signed module that was loaded from System32
4. The driver's code comes from a kernel module that has been hidden, a common rootkit technique

Question 45

Data theft from a laptop is suspected, and an analyst wants to know how many bytes a particular executable sent over the network during the past weeks. Which SRUM table, parsed by tools such as SrumECmd, holds this information?

1. The Application Resource Usage table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}
2. The Network Data Usage table {973F5D5C-1D90-4944-BE8E-24B94231A174}
3. The Push Notifications table {D10CA2FE-6FCF-4F6D-848E-B2E99266FA86}
4. The SruDbCheckpointTable

Question 46

A payload on a server relaunches on a schedule, yet schtasks /query and the Task Scheduler console list no suspicious task. The Tarrask malware family is suspected. Which technique hides a scheduled task from these views?

1. Deleting the task's Security Descriptor (SD) registry value, which requires SYSTEM permissions
2. Renaming the task so that its name resembles a built-in Microsoft task
3. Clearing the Task Scheduler operational event log after the task is registered
4. Encoding the task's action command line in Base64

Question 47

Memory analysis shows processes running in an RDP-Tcp session on a file server. The analyst searches the Security log for the matching successful logon event 4624. Which Logon Type value identifies a Remote Desktop logon?

1. 2
2. 3
3. 5
4. 10

Question 48

During an intrusion, the team proposes redirecting the attacker to a sandbox to observe their tooling before containing the compromised servers. According to NIST SP 800-61r3, what should the team do before executing this strategy?

1. Discuss its feasibility with the legal department, accepting that the delay could let the attacker escalate access
2. Eradicate every persistence mechanism first so that the sandbox stays isolated
3. Notify the attacker's internet service provider so that it can monitor the session
4. Restore the compromised servers from backup so that production data is protected

Question 49

An RDP session found in memory had been idle, and the analyst suspects an attacker reconnected to the existing, disconnected session instead of starting a new one. Which Security event records a reconnection to an existing session, including the client's IP address?

1. 4778
2. 4779
3. 4672
4. 4688

Question 50

On a busy file server, an analyst parses $UsnJrnl:$J but finds no records older than nine days, although the intrusion began a month ago. What is the most likely reason?

1. The journal has a maximum size, and NTFS removes the earliest records as new ones arrive
2. The journal keeps exactly nine days of records by design, regardless of its size
3. The attacker must have wiped the journal, because NTFS never discards records
4. USN records older than a week are moved into $LogFile

Question 51

A new team member proposes installing Volatility 3 on a compromised workstation and using it to capture the workstation's RAM before analysis begins. What is wrong with this plan?

1. Volatility 3 analyzes memory images but does not acquire memory, so a capture tool such as WinPmem or FTK Imager must create the image first
2. Volatility 3 can capture RAM only from Linux systems, so a Windows build of it is needed
3. Volatility 3 can capture RAM only after it has generated a symbol table from the live kernel
4. Volatility 3 captures memory only by copying hiberfil.sys, so the workstation must hibernate first

Question 52

While recovering from a full Active Directory domain compromise, the team follows Microsoft guidance to reset the krbtgt account password twice. What is the reason for the second reset?

1. The first reset takes effect only after the next scheduled replication cycle
2. Each domain controller must confirm the new password with a second reset
3. Two resets are needed because the RC4 and AES keys are changed separately
4. The account keeps a password history of two, so a second reset clears the old password

Question 53

A workstation's Security log shows event 4720 for an account named helpdesk_svc, followed seconds later by event 4732 naming the same account as the new member. Which attacker action does this sequence most likely represent?

1. Resetting the password of an existing local account
2. Enumerating the members of the local Administrators group
3. Creating a new user account and adding it to a security-enabled local group such as Administrators
4. Re-enabling a local account that an administrator had disabled

Question 54

A Sysmon Event ID 10 entry shows SourceImage C:\ProgramData\svc\wupd.exe, TargetImage C:\Windows\System32\lsass.exe and GrantedAccess 0x1010. What does the access mask indicate the source process obtained?

1. The right to read lsass.exe memory plus limited query information, consistent with credential dumping
2. The right to terminate lsass.exe, consistent with a denial-of-service attempt
3. The right to create new threads in lsass.exe, consistent with remote thread injection
4. The right to change the priority class of lsass.exe, consistent with performance tuning

Question 55

An endpoint stopped sending process telemetry to the EDR console shortly before ransomware ran. The analyst runs the Volatility 3 etwpatch plugin, which reports that EtwEventWrite in ntdll.dll inside several processes begins with a RET instruction. What does this indicate?

1. The ETW functions were updated by a Windows cumulative update that changed their prologue
2. The processes were compiled without Event Tracing for Windows support
3. Malware patched the ETW write function so that events from those processes are never delivered to security tools
4. The system was running in safe mode, which disables ETW providers

Question 56

A sales laptop records 4624 events with logon type 11 whenever its owner signs in at a hotel before connecting to the corporate VPN. How should the analyst interpret these events?

1. As a pass-the-hash attempt, because no domain controller was contacted
2. As Remote Desktop sessions arriving through the hotel network
3. As normal cached interactive logons using locally stored domain credentials
4. As service logons started before the VPN connected

Question 57

In a report, an analyst must explain why windows.pslist and windows.psscan can return different results for the same memory image. Which data source does windows.pslist use to enumerate processes?

1. A scan of physical memory for pool allocations tagged as process objects
2. The ready queues of each processor's control region
3. The handle table of the csrss.exe process
4. The doubly linked list of EPROCESS structures reached from the kernel symbol PsActiveProcessHead through each ActiveProcessLinks entry

Question 58

To corroborate USN journal findings about files created and renamed minutes before a server crashed, an analyst wants the NTFS transaction log that the file system replays to restore consistency after a failure. Which metadata file holds it?

1. $Bitmap, MFT entry 6
2. $MFTMirr, MFT entry 1
3. $LogFile, MFT entry 2
4. $Secure, MFT entry 9

Question 59

An analyst building a user activity timeline sees a 4624 event with logon type 7 for the user's own account at 13:02, shortly after the user returned from lunch. What does this logon type record?

1. The workstation was unlocked
2. The user signed in over Remote Desktop
3. A scheduled task ran on the user's behalf
4. The user mapped a network drive

Question 60

An analyst compares a suspect host's process tree against a known-good Windows 11 baseline. Which process is the normal parent of services.exe, the Service Control Manager?

1. smss.exe
2. winlogon.exe
3. System
4. wininit.exe

Question 61

An analyst is documenting the normal security context of services that run as LocalSystem in order to judge whether a suspicious service's access is expected. Which statement about the LocalSystem account is accurate?

1. It has a randomly generated password that Windows rotates every 30 days
2. It presents anonymous credentials when it accesses network resources
3. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs, and it can open HKLM\SECURITY
4. Its HKEY_CURRENT_USER key maps to the profile of the user who is currently logged on

Question 62

An organization runs Sysmon on all endpoints. Hunters want to find processes that changed the creation time of files, for example to make a backdoor look as old as the operating system. Which Sysmon event should they query?

1. Event ID 11, FileCreate
2. Event ID 15, FileCreateStreamHash
3. Event ID 2, a process changed a file creation time
4. Event ID 23, FileDelete

Question 63

A shortcut in a user's Recent folder points to E:\Projects\bid_final.xlsx, a file that no longer exists anywhere. LECmd shows CreationTime, AccessTime, and WriteTime values in the shortcut's header. What do these three header timestamps describe?

1. When the shortcut file itself was created, accessed, and modified, in local time
2. When the volume E: was first mounted, last mounted, and last removed
3. When the user first opened, last opened, and last saved the shortcut through Explorer, in local time
4. The creation, access, and write times of the target file, stored in UTC

Question 64

Responders know an attacker moved laterally by supplying a stolen administrator password to tools that accept alternate credentials. They want the source workstations, not the targets. Which Security event, logged on the source host, records a logon attempt made with explicitly specified credentials?

1. Event ID 4624 with Logon Type 3
2. Event ID 4697
3. Event ID 4648
4. Event ID 4672

Question 65

In a user's Recent\AutomaticDestinations folder, an analyst finds several files whose names start with a 16-character hexadecimal string followed by .automaticDestinations-ms. What does the hexadecimal part of each file name identify?

1. The NTFS file reference of the most recently opened document
2. A hash of the user's SID, so each user has one Jump List file
3. The date and time the Jump List was created, as a FILETIME
4. The application the Jump List belongs to, derived from the path of its executable

Question 66

During live response on a Windows Server 2022 Remote Desktop host, a responder wants a quick list of the sessions on the server, showing each session name, user name, session ID and state, such as active or disconnected. Which built-in command provides this?

1. tasklist /svc
2. netstat -ano
3. whoami /all
4. query session

Question 67

In a user's RecentDocs\.pdf subkey, the MRUListEx value begins 07 00 00 00 02 00 00 00, and the subkey's last written time is 2026-09-30 14:02 UTC. What can the analyst conclude?

1. The value named 0 is the most recently opened PDF, because values are numbered from newest to oldest.
2. The value named 7 holds the most recently opened PDF, which was most likely opened around 14:02 UTC on 30 September.
3. Each numbered value stores its own open time, so the key's last written time is not relevant.
4. The value named 2 holds the most recently opened PDF, because MRUListEx lists items from oldest to newest.

Question 68

Pslist shows 70 svchost.exe processes on a Windows 11 workstation. For one of them, dlllist reports the image path C:\Users\Public\svchost.exe, and its parent is explorer.exe rather than services.exe. Which technique does this most likely represent?

1. Service host refactoring, which runs each service in its own svchost.exe
2. Masquerading, giving malware the name of a trusted Windows program to blend in
3. Process hollowing, which always moves the image to a public folder
4. Normal per-user service hosting for applications installed by the user

Question 69

In a user's folder under C:\$Recycle.Bin on a Windows 10 system, an analyst finds a pair of files named $IR8K2FQ.docx and $RR8K2FQ.docx. Which information does the $I file provide?

1. The full contents of the deleted document
2. The SHA-1 hash of the document at the time of deletion
3. The name of the process that sent the document to the Recycle Bin
4. The document's original path and name, its original size, and the date and time it was deleted

Question 70

After containing an intrusion, the team deletes the attacker's malware, disables the breached accounts, and patches the exploited VPN flaw on every affected host. Under NIST SP 800-61r3, which activity is the team performing?

1. Eradication
2. Containment
3. Recovery
4. Detection

Question 71

Sessions plugin output from a Windows 10 workstation shows the processes grouped by session ID. Which observation departs from normal session usage on modern Windows and deserves a closer look?

1. An explorer.exe shell process running in session 0
2. Svchost.exe and services.exe processes running in session 0
3. The first interactive user's explorer.exe running in session 1
4. A second user's explorer.exe running in session 2

Question 72

An analyst already has a full body file for a compromised server and wants mactime to output only the activity in the range bounded by 2026-03-02 and 2026-03-04. Which command uses the correct date range syntax?

1. mactime -b body.txt -i day 2026-03-02 2026-03-04
2. mactime -b body.txt -r 2026-03-02:2026-03-04
3. mactime -b body.txt 2026-03-02..2026-03-04
4. mactime -b body.txt -y 03/02/2026-03/04/2026

Question 73

A timeline from a database server shows a 4624 network logon for a service desk account, immediately followed by a 4672 event carrying the same Logon ID. What does the 4672 event add to the investigation?

1. The account's password was changed during the logon.
2. The logon was made with credentials typed into a RUNAS prompt.
3. The logon resumed a previously disconnected session.
4. The new logon session was assigned sensitive privileges such as SeDebugPrivilege or SeBackupPrivilege.

Question 74

While checking a body file produced by fls from a Windows 10 image, an analyst examines the line below.

0|C:/Users/kim/AppData/Local/Temp/svc.exe|105233-128-3|r/rrwxrwxrwx|0|0|73728|1780000000|1779990000|1779990000|1779980000

In what form are the last four numeric fields, the file's time values, recorded?

1. Windows FILETIME values counting 100-nanosecond intervals since 1 January 1601
2. Local times of the analysis workstation written as YYYYMMDDhhmmss strings
3. UNIX time values in the order atime, mtime, ctime and crtime
4. Seconds elapsed since the volume was formatted, taken from the boot sector

Question 75

An attacker's keylogger repeatedly appends captured keystrokes to the default data stream of C:\Users\Public\log.dat. Which USN reason flag best reflects these appended writes in the change journal?

1. USN_REASON_DATA_TRUNCATION
2. USN_REASON_DATA_EXTEND
3. USN_REASON_NAMED_DATA_EXTEND
4. USN_REASON_BASIC_INFO_CHANGE

Question 76

The Volatility 3 cmdline plugin shows the following command line for a short-lived process on a file server.

rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 712 C:\Windows\Temp\d.dmp full

PID 712 is lsass.exe. What was the attacker most likely doing?

1. Registering comsvcs.dll as a new COM server for persistence
2. Collecting a crash dump of rundll32.exe for Windows Error Reporting
3. Dumping LSASS process memory with a built-in Windows DLL to harvest credentials offline
4. Exporting the SAM hive to a file so password hashes can be cracked

Question 77

In a mactime timeline built from an NTFS volume, the row below appears for a suspicious executable.

Tue Mar 03 2026 14:22:09 73728 ..c. r/rrwxrwxrwx 0 0 105233-128-3 C:/Users/kim/AppData/Local/Temp/svc.exe

What does the activity code tell the analyst about this moment?

1. The file was created at this time
2. The file's MFT entry, its metadata, was modified at this time
3. The file's content was last written at this time
4. The file was last opened for reading at this time

Question 78

A suspicious service DLL shows identical 2018 creation times in both $STANDARD_INFORMATION and $FILE_NAME, so an SI versus FN comparison raises no alert, yet the host was built in 2025. Which approach best tests whether the times were manipulated?

1. Correlate with independent NTFS records such as the USN journal and $LogFile, which log changes as they actually occur
2. Accept the values, because $FILE_NAME times cannot be changed by any means
3. Validate the creation time against the DLL's $STANDARD_INFORMATION last-access time
4. Validate the creation time against the DLL's $STANDARD_INFORMATION modification time

Question 79

A hunting rule searches every server for the default service name that PsExec creates, yet a confirmed intrusion that used PsExec produced no hits. Which PsExec option lets an operator choose the name of the remote service it creates?

1. -s
2. -c
3. -r
4. -i

Question 80

Pebmasquerade output for PID 5120 shows EPROCESS_ImageFileName rundll32.exe and an EPROCESS_SeAudit_ImageFileName ending in rundll32.exe, while PEB_ImageFilePath is C:\Windows\explorer.exe and PEB_ImageFilePath_Spoofed is True. What is the best conclusion?

1. The process is rundll32.exe and its user-mode PEB was edited to make it look like explorer.exe
2. The process is explorer.exe and the kernel recorded the wrong name during creation
3. Explorer.exe was renamed to rundll32.exe on disk after the process started
4. The PEB path is correct because it is protected from modification by user-mode code