GCIA Incident Response and Forensics 2

Question 1

During a digital forensics investigation, which file system artifact in NTFS records metadata about deleted files and their locations?

Accepted Answer

$MFT

Answer

The $MFT (Master File Table) in NTFS records metadata for every file including deleted ones until the entry is overwritten.

Question 2

An analyst observes outbound connections from an internal host to external IPs on port 443 with unusually high data volumes at regular intervals. This behavior is MOST indicative of:

Accepted Answer

Beaconing C2 traffic with data exfiltration

Answer

Regular interval outbound connections with large data volumes on 443 strongly indicate beaconing C2 activity combined with data exfiltration.

Question 3

During memory forensics, which Volatility plugin would you use to identify injected code in a running process?

Accepted Answer

malfind

Answer

The 'malfind' plugin scans process memory for regions with executable permissions and no corresponding mapped file, indicating code injection.

Question 4

In the PICERL incident response model, which phase immediately follows 'Identification'?

Accepted Answer

Containment

Answer

PICERL stands for Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned — Containment follows Identification.

Question 5

A forensic analyst needs to preserve evidence integrity. Which tool creates a forensic image while simultaneously generating a cryptographic hash of the source drive?

Accepted Answer

dcfldd

Answer

dcfldd is an enhanced version of dd that natively hashes data during imaging, ensuring a verified forensic copy in one step.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Incident Response and Forensics 2