Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A forensic analyst is examining a memory dump from a Windows 10 system that experienced frequent crashes. The System event log extracted from memory shows repeated event ID 41 (Kernel-Power) entries, but no corresponding BugCheck (event ID 1001) entries. The analyst also finds a driver file in memory that is not present in the on-disk driver store. What is the most likely conclusion?

   • AThe system crashed due to a faulty driver that was loaded from a temporary location, and the BugCheck events may have been suppressed or not logged
   • BThe system was shut down normally by a user, and the driver is a legitimate part of the operating system
   • CThe system was infected with malware that deleted the BugCheck events, and the driver is a rootkit
   • DThe crashes were caused by a hardware failure, and the driver file is irrelevant
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are analyzing a memory dump from a Windows 10 system. You need to determine whether any event log records exist for a specific time period. The system uses the modern Windows Event Log format. Which location in memory would you examine to find event log records?

   • AThe registry hives, which store event log records in binary form
   • BThe kernel's paged pool, which contains all event log records
   • CThe memory-mapped file for the .evtx files, which are loaded into memory by the Event Log service
   • DThe system call table, which contains event log entries
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You are analyzing a memory dump and find Event ID 4624 (logon) with a logon type of 10 (remote interactive) at 09:00:00. You also find a process (cmd.exe) with a start time of 09:01:00 and a parent process of svchost.exe. Which conclusion is most strongly supported by correlating these artifacts?

   • AA user logged on via remote desktop and then launched a command prompt, which is consistent with remote administrative activity.
   • BThe user logged on locally and then used a remote tool to launch cmd.exe.
   • CThe logon event is fake because cmd.exe cannot start after an RDP logon.
   • DThe cmd.exe process is malicious because its parent is svchost.exe.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of correlating event log entries with memory artifacts to reconstruct user activity?

   • AMatching a logon event's timestamp with the creation time of a process in memory
   • BChecking the event log for the computer's IP address
   • CComparing the event log file size with the memory dump size
   • DVerifying that the event log service is running in memory
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   You are analyzing a memory dump from a compromised server. The Security event log extracted from memory shows event ID 4624 logons for a user account, but the timestamps are all identical (e.g., 10:00:00) for multiple different logon events. You also find that the event log service was restarted multiple times. What does this pattern suggest?

   • AThe system clock was not synchronized, causing all events to have the same timestamp
   • BThe event log records were tampered with, possibly to obscure the actual timing of logons
   • CThe user logged on multiple times within the same second, which is a normal occurrence
   • DThe event log service restarts caused the timestamps to be reset
   Reveal Solution Discussion Select an answer first