GCIA Incident Response and Forensics 3

Question 1

An analyst reviewing Snort logs sees the alert signature 'ET SCAN Nmap Scripting Engine User-Agent Detected'. What does this MOST likely indicate?

Accepted Answer

Active reconnaissance using Nmap with NSE scripts

Answer

A false positive from legitimate scanning software

Answer

Malware using Nmap libraries for C2

Answer

An IDS evasion attempt via user-agent spoofing

Question 2

When performing timeline analysis in a forensics investigation, which artifact provides the most granular NTFS file system timestamps?

Accepted Answer

$MFT entries with MACB times

Answer

Event Viewer logs

Answer

Prefetch files

Answer

Windows registry LastWrite times

Question 3

A network capture shows an internal host sending small UDP packets to many different external IPs on port 53 followed by unusually long responses. This pattern suggests:

Accepted Answer

DNS amplification attack or DNS tunneling exfiltration

Answer

Normal recursive DNS resolution

Answer

LLMNR poisoning attack

Answer

ARP spoofing using DNS

Question 4

During an IR engagement, you discover PowerShell scripts executed with the flag '-EncodedCommand'. What does this indicate?

Accepted Answer

Base64-encoded command execution to evade signature-based detection

Answer

PowerShell remoting to a remote system

Answer

Scheduled task execution via PowerShell

Answer

PowerShell running in constrained language mode

Question 5

Which artifact is MOST useful for determining whether a file was executed on a Windows system even if the file has since been deleted?

Accepted Answer

Windows Prefetch files (.pf)

Answer

Recycle Bin $I files

Answer

Shadow copies

Answer

Event log 4663

Question 6

An attacker uses the command 'net use \targethost\C$ /user:domain\admin password'. What stage of an attack does this MOST likely represent?

Accepted Answer

Lateral movement via SMB administrative share

Answer

Initial access via phishing

Answer

Privilege escalation via token impersonation

Answer

Persistence via scheduled task creation

Question 7

Which SIEM query approach would BEST detect Pass-the-Hash attacks in Windows event logs?

Accepted Answer

Event ID 4624 with Logon Type 3 and NTLM authentication from unexpected sources

Answer

Event ID 4625 showing failed login attempts

Answer

Event ID 7045 showing new service installations

Answer

Event ID 4688 showing process creation events