Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are analyzing a memory dump and find Event ID 4625 (failed logon) with a logon type of 3 (network) from an IP address that has attempted logons multiple times. Which additional event log record would best help you determine if this is a brute-force attack?

   • AEvent ID 1102 (Security log cleared) to see if the log was cleared after the attempts.
   • BEvent ID 4624 (successful logon) from the same IP address shortly after the failed attempts.
   • CEvent ID 6005 (Event Log service started) to confirm the system boot time.
   • DEvent ID 1074 (system shutdown) to see if the system was rebooted during the attempts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an incident response, you acquire a memory dump from a compromised Windows 10 workstation. Using Volatility 3, you extract event log records from memory. You find a series of Security event ID 4624 (logon) entries with LogonType 3, followed by event ID 4672 (special privileges assigned) for the same account. The user denies having accessed the server at that time. Which additional memory artifact would best corroborate that these logon events were network-based and not local console access?

   • AThe presence of a network share connection artifact, such as a NetBIOS session or SMB session record, tied to the same timestamp and account
   • BAn event ID 4776 (credential validation) entry for the same account in the extracted event logs
   • CA scheduled task entry in memory that ran at the same time as the logon events
   • DA Windows Defender detection log entry in the Application event log from the same time
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of constructing a timeline from parsed event logs?

   • ATo establish the sequence of activities and events for forensic analysis
   • BTo identify the IP addresses of all network connections
   • CTo verify the integrity of the event log files
   • DTo determine the size of the event log files
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a required component of a parsed event log record that provides the time the event occurred?

   • ALevel
   • BSource
   • CUser
   • DTimestamp
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are analyzing a memory dump from a server that was compromised. You find an event log record with Event ID 4624 (successful logon) showing a logon type of 3 (network) from an IP address that is not in the allowed list. Which additional memory artifact would best help you determine whether this logon led to malicious activity?

   • AA list of active network connections and associated process names from the memory dump.
   • BThe contents of the recycle bin from the memory dump.
   • CThe system's uptime and last shutdown time from the memory dump.
   • DThe list of installed patches from the registry hive in memory.
   Reveal Solution Discussion Select an answer first