Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When analyzing network connection artifacts in memory, which field is most important for correlating a connection to a specific malicious process?

   • ALocal port number
   • BProcess ID (PID)
   • CConnection state
   • DRemote IP address
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic analyst is reconstructing the timeline of a malware infection from a memory image. The analyst finds the following artifacts: (1) a process 'malware.exe' started at 10:00, (2) an outbound connection to an external IP at 10:05, (3) a registry run key created at 10:10, and (4) a file 'C:\Users\Public\payload.dll' created at 10:15. Which sequence best represents the likely order of events?

   • AProcess start, network connection, registry key, file creation
   • BRegistry key, process start, network connection, file creation
   • CFile creation, process start, network connection, registry key
   • DNetwork connection, process start, registry key, file creation
   Reveal Solution Discussion Select an answer first
4. 8expert · hard · select all that apply

   A forensic analyst is examining a memory image from a server that is suspected of being used as a botnet node. The analyst needs to identify volatile artifacts that would indicate the botnet's presence and activity. Which of the following artifacts should the analyst prioritize? Select all that apply.

   • AProcess listings for unusual or hidden processes
   • BRegistry hives for persistence mechanisms
   • CThe system's uptime
   • DThe system's hostname
   • ENetwork connections to known botnet C2 servers
   Check answers Discussion Select an answer first
5. 9expert · hard

   You are analyzing a memory image from a compromised domain controller. You find a process 'spoolsv.exe' with a suspicious memory section that contains a PE header. You also find a registry key under 'HKLM\SYSTEM\CurrentControlSet\Services' that points to a DLL in 'C:\Windows\System32\spoolsv.dll'. The process has an outbound connection to an external IP on port 443. Which correlation of volatile artifacts best indicates the attack vector and persistence?

   • AThe outbound connection on port 443 indicates the attacker is using HTTPS for C2, but the injected code is unrelated to the connection.
   • BThe injected code in spoolsv.exe, the service registry entry, and the outbound connection together indicate the PrintNightmare exploit was used to load a malicious DLL and establish C2 communication.
   • CThe service registry entry is the persistence mechanism, but the injected code is a false positive because spoolsv.exe is a system process.
   • DThe registry entry proves that the spoolsv.exe process is legitimate, and the outbound connection is normal for a domain controller.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are analyzing a memory image from a Windows host. You extract the SYSTEM registry hive and find a new service named 'LegitSvc' with a start type of 0 (SERVICE_BOOT_START) and an image path of 'C:\ProgramData\LegitSvc.exe'. You also find a network connection from a process with the same name to an external IP. Which registry artifact would you also examine to understand the service's behavior and persistence?

   • AThe service's 'Security' descriptor, which controls who can modify the service.
   • BThe service's 'FailureActions' subkey, which determines what happens if the service fails.
   • CThe service's 'Enum' subkey, which lists the device instances associated with the service.
   • DThe service's 'Parameters' subkey, which may contain configuration data used by the service.
   Reveal Solution Discussion Select an answer first