Analyzing Volatile Windows Event Artifacts GCFA Practice Questions (Page 9)

Questions 41–43

1. 41expert · hard

   While analyzing a memory dump, you notice that the Security event log in memory contains a continuous sequence of Event ID 4624 (logon) records, but there is a gap of 15 minutes where no events appear. The system was running normally during that period. Which conclusion is most consistent with this observation?

   • AThe event log service automatically compresses old records during periods of low activity.
   • BThe 15-minute gap is normal because the system was idle and no logon events occurred.
   • CThe event log buffers in memory may have been overwritten or the log service temporarily stopped, indicating possible anti-forensic activity.
   • DThe system was likely rebooted during that 15-minute gap, and the memory dump captured only the post-reboot events.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is an example of an anti-forensic technique that attackers may use to manipulate event artifacts?

   • AChanging the event log file location
   • BDeleting specific event records from the log
   • CEnabling verbose logging
   • DIncreasing the maximum log size
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   You are reviewing event records parsed from a memory dump and find multiple Event ID 4672 (special privileges assigned to new logon) entries for the same user account within a short time period. Which interpretation is most appropriate?

   • AThe event indicates a failed logon attempt, so the user is locked out.
   • BThe event indicates that the user is trying to clear the event logs.
   • CThe user may be performing administrative tasks that require elevated privileges, but it could also indicate an attacker abusing a privileged account.
   • DThe user's account is definitely compromised because administrative privileges are being used.
   Reveal Solution Discussion Select an answer first