Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which memory forensics technique is specifically designed to detect a process that has been hidden from the active process list by kernel-level rootkit manipulation?

   • AString extraction from the process heap
   • BHash comparison of executable files
   • CNetwork connection enumeration
   • DCross-view analysis of process structures
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When correlating volatile artifacts to reconstruct a malicious event, which combination of artifacts is most effective for establishing the initial infection vector?

   • APrefetch files and MFT
   • BLoaded kernel modules and services
   • CRegistry hives and event logs
   • DProcess list, network connections, and command-line arguments
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which volatile artifact, when extracted from a memory image, would be most useful for identifying a persistence mechanism that runs a malicious command at every system startup?

   • ANetwork connections
   • BProcess environment variables
   • CLoaded kernel modules
   • DRegistry hives
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are analyzing a memory image from a compromised web server. You find a process 'w3wp.exe' that has a child process 'cmd.exe' with the command line 'cmd.exe /c whoami'. You also see an outbound TCP connection from 'cmd.exe' to an internal IP on port 445. The server's firewall logs show that the internal IP is a file server. Which conclusion is best supported by correlating these volatile artifacts?

   • AThe outbound connection to port 445 indicates the attacker is exfiltrating data to the file server, so the file server is also compromised.
   • BThe cmd.exe process is a false positive because it is a child of w3wp.exe, which is a legitimate system process.
   • CThe web server was compromised and the attacker used the cmd.exe process to perform reconnaissance and then attempted to access the file server via SMB.
   • DThe w3wp.exe process is malicious because it spawned cmd.exe, which is never a legitimate action.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic analyst is examining a memory image from a compromised Windows workstation. The analyst runs a process listing and notices a process named 'svchost.exe' with a parent process of 'cmd.exe'. The process path is 'C:\Users\Public\svchost.exe'. Which volatile artifact should the analyst prioritize for further investigation?

   • AThe process's parent-child relationship and executable path
   • BThe process's memory protection attributes
   • CThe process's CPU time
   • DThe process's thread count
   Reveal Solution Discussion Select an answer first