GCIA Incident Response and Forensics 2

Question 1

During a digital forensics investigation, which file system artifact in NTFS records metadata about deleted files and their locations?

Accepted Answer

$MFT

Answer

$LogFile

Answer

$Recycle.Bin

Answer

$UsnJrnl

Question 2

An analyst observes outbound connections from an internal host to external IPs on port 443 with unusually high data volumes at regular intervals. This behavior is MOST indicative of:

Accepted Answer

Beaconing C2 traffic with data exfiltration

Answer

Normal HTTPS browsing activity

Answer

Windows Update traffic

Answer

DNS over HTTPS queries

Question 3

During memory forensics, which Volatility plugin would you use to identify injected code in a running process?

Accepted Answer

malfind

Answer

pslist

Answer

dlllist

Answer

handles

Question 4

In the PICERL incident response model, which phase immediately follows 'Identification'?

Accepted Answer

Containment

Answer

Preparation

Answer

Eradication

Answer

Recovery

Question 5

A forensic analyst needs to preserve evidence integrity. Which tool creates a forensic image while simultaneously generating a cryptographic hash of the source drive?

Accepted Answer

dcfldd

Answer

dd with md5sum piped

Answer

Wireshark

Answer

Autopsy

Question 6

Which Windows Registry hive contains information about recently accessed USB storage devices connected to a system?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

HKLM\SECURITY\Policy\Secrets

Question 7

During live response on a Linux system, an analyst wants to capture volatile data before shutting down. Which command captures the current network connections and listening ports?

Accepted Answer

ss -tunap

Answer

netstat -r

Answer

ifconfig -a

Answer

iptables -L