Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is the default storage location for Windows Event Log files on a modern Windows system?

   • AC:\ProgramData\Microsoft\EventLogs
   • BC:\Windows\System32\winevt\Logs
   • CC:\Windows\System32\config
   • DC:\Windows\System32\LogFiles
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the difference between classic Windows event logs and the modern Windows Event Log format?

   • AClassic logs are stored in the registry, while modern logs are stored in the file system.
   • BClassic logs can only be read by the Event Viewer, while modern logs can be read by any text editor.
   • CClassic logs are only available on client editions of Windows, while modern logs are available on server editions.
   • DClassic logs use a binary .evt format with a fixed set of logs, while modern logs use an XML-based .evtx format that supports custom logs and structured data.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   You are analyzing a memory dump and find Event ID 4672 (special privileges assigned to new logon) for a user account that is not in the administrators group. You also find Event ID 4624 (logon) for the same user with a logon type of 2 (interactive) at the same time. Which conclusion is most consistent with these artifacts?

   • AThe user may have been granted temporary administrative privileges, or the account may have been compromised and elevated by an attacker.
   • BThe user is definitely an administrator because Event ID 4672 is only generated for administrators.
   • CThe user's account is compromised because Event ID 4672 is always a sign of malicious activity.
   • DThe event log is corrupted because a non-admin user cannot have special privileges.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a forensic analysis of a memory dump, you extract Security event logs and find a series of event ID 4625 (logon failure) entries with LogonType 3 and a SubStatus of 0xC000006A (bad password). The failures occur every 2 seconds for 10 minutes from a single source IP, followed by a successful logon (event ID 4624) from the same IP. Which conclusion is most supported by this evidence?

   • AA brute-force attack was attempted, and the attacker eventually succeeded
   • BThe account was locked out due to the failures, and the successful logon was from a different user
   • CThe failures were caused by a misconfigured service account, and the success was a scheduled task
   • DThe user simply forgot their password and then typed it correctly
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an incident response, you have a memory dump from a compromised Windows 10 workstation. The on-disk event logs have been cleared, but you suspect that event records may still exist in the memory dump. Which approach is most likely to recover event records from the memory dump?

   • AUse a hex editor to search the memory dump for the string '.evtx' and manually reconstruct the log files.
   • BRun a file carving tool on the memory dump to recover the deleted .evtx files from unallocated disk space.
   • CUse a memory forensics framework to locate and parse the Windows Event Log buffers that were resident in memory at the time of acquisition.
   • DReboot the system and immediately copy the event log files before the system fully starts.
   Reveal Solution Discussion Select an answer first