Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   You are investigating a privilege escalation incident. From a memory dump, you extract Security event logs showing event ID 4672 (special privileges assigned) for a standard user account at 10:00:00. You also find that the user's token in memory has been modified to include the SeDebugPrivilege. The user account is not a member of any administrative group. Which conclusion is most supported?

   • AThe user is a member of a group that grants SeDebugPrivilege, and the event log is correct
   • BThe user exploited a vulnerability to escalate privileges, and the token modification is evidence of that
   • CThe token modification is a result of a kernel bug, and the event log is unrelated
   • DThe event ID 4672 is a normal occurrence for all logons, and the token modification is a false positive
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   You have a memory dump from a system where the on-disk event logs have been securely deleted using a disk-wiping tool. You need to recover event log data. Which approach is most likely to yield useful evidence?

   • AParse the event log buffers from the memory dump, which may contain recent events that were not yet written to disk.
   • BSearch the memory dump for the event log file paths and reconstruct the files from disk remnants.
   • CUse a disk recovery tool to recover the wiped event log files from the disk.
   • DReboot the system and immediately copy the event log files before the system fully starts.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are investigating a system where a user reported that an application crashed repeatedly. In the memory dump, you find Event ID 1000 (Application Error) from the Application log. Which additional event log record would best help you determine the root cause of the crash?

   • AEvent ID 4624 (successful logon) to see which user was logged on during the crash.
   • BEvent ID 1074 (system shutdown) to see if the crash caused a reboot.
   • CEvent ID 6005 (Event Log service started) to confirm the system boot time.
   • DEvent ID 1001 (Windows Error Reporting) that includes the faulting module and exception code.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When correlating event log entries with other memory artifacts, which of the following is most useful for linking a user's activity to a specific process?

   • ANetwork connections from the memory dump
   • BFile system timestamps from the disk
   • CRegistry hives from the memory dump
   • DProcess ID (PID) and parent process ID (PPID) from memory
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are analyzing a memory dump and find that the Security event log contains Event ID 1102 (Security log cleared) at 14:00:00. However, you also find Event ID 4624 (logon) records with timestamps after 14:00:00. What is the most likely explanation?

   • AThe memory dump is from a different system because the log clearing should have removed all subsequent events.
   • BThe log was cleared, but subsequent logon events were generated after the clearing and are present in memory.
   • CThe timestamps are incorrect because the system clock was changed after the log was cleared.
   • DThe attacker cleared the log but then restored it from a backup, which included the later logon events.
   Reveal Solution Discussion Select an answer first