Manual Triage GBFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   During a live triage of a Windows system, you notice an unknown process with a high CPU usage and an established outbound network connection to an unfamiliar IP address. Which immediate action best aligns with manual triage principles?

   • ARecord the process name, PID, executable path, and the remote IP/port, then check if the executable path is legitimate.
   • BBlock the remote IP address in the firewall to prevent further communication.
   • CCopy the executable file to a forensic image before doing anything else.
   • DTerminate the process immediately to stop potential data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During triage of a Windows system, you need to determine if a specific USB device was connected. Which registry location is most relevant to check?

   • AHKCU\Software\Microsoft\Internet Explorer\TypedURLs
   • BHKCU\Software\Microsoft\Windows\CurrentVersion\Run
   • CHKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
   • DHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization suspects an insider has been exfiltrating data via cloud storage. During triage of the user's workstation, which evidence source should be prioritized to confirm this activity?

   • AThe Windows event log for system shutdown events
   • BBrowser history and downloaded files from cloud storage providers
   • CThe system's BIOS version
   • DThe user's wallpaper image file
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a manual triage of a suspected data-exfiltration workstation, you need to quickly identify which user accounts were active at the time of the incident. The system is running and you have local administrator access. Which approach best prioritizes the most relevant evidence for this goal?

   • ACheck the prefetch folder for recently executed programs and map them to user profiles.
   • BReview the Security event log for logon events and correlate with running processes and network connections.
   • CCapture a full memory dump and then analyze it offline for user credentials and browsing history.
   • DExamine the browser history of all user profiles to see which accounts accessed external sites.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During triage of a Windows system, you find a suspicious executable in the Downloads folder. Which artifact would provide the quickest evidence of when and how many times that executable was run?

   • AThe Windows Event Log for application errors
   • BBrowser history in the user's profile
   • CThe $MFT entry for the executable
   • DPrefetch files in C:\Windows\Prefetch
   Reveal Solution Discussion Select an answer first