Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   You are examining a memory dump from a Windows Server 2019 system. You find event records that appear to be from the classic Security log (with a record structure that includes a 16-bit header). Which statement about classic versus modern event logs is correct in this context?

   • AClassic event logs are always stored in memory, while modern logs are always stored on disk.
   • BClassic event logs are stored in .evtx files, while modern logs are stored in .evt files.
   • CClassic event logs use a binary format with a fixed header, while modern logs use an XML-based format with a different header structure.
   • DClassic event logs cannot be parsed from memory dumps because they are not cached.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When parsing event log records from a memory dump, which of the following fields is essential for identifying the specific event that occurred?

   • ARecord Number
   • BEvent ID
   • CEvent Category
   • DComputer Name
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which Windows security event ID indicates a successful logon?

   • A4625
   • B4624
   • C4672
   • D4634
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When acquiring volatile event log data from a memory dump, which of the following is the most reliable method?

   • AUsing a hex editor to search for event log signatures in the memory dump.
   • BCopying the .evtx files from the live system before shutting it down.
   • CRunning the wevtutil command on the live system to export logs.
   • DParsing the event log buffers directly from the memory dump using a memory forensics framework.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You are parsing event log records from a memory dump and find an event with a source name that is not a standard Windows component. Which step is most appropriate to determine if this event is relevant to the investigation?

   • AIgnore the event because non-standard sources are not relevant to forensic investigations.
   • BCorrelate the event with other memory artifacts, such as processes and network connections, to see if it is associated with suspicious activity.
   • CAssume the event is from a third-party application and therefore not malicious.
   • DDelete the event from the parsed log to avoid confusion.
   Reveal Solution Discussion Select an answer first