GCIA Incident Response and Forensics 3

Question 1

An analyst reviewing Snort logs sees the alert signature 'ET SCAN Nmap Scripting Engine User-Agent Detected'. What does this MOST likely indicate?

Accepted Answer

Active reconnaissance using Nmap with NSE scripts

Answer

The Nmap Scripting Engine (NSE) sends a distinctive user-agent string that ET OPEN rules detect, indicating active network reconnaissance.

Question 2

When performing timeline analysis in a forensics investigation, which artifact provides the most granular NTFS file system timestamps?

Accepted Answer

$MFT entries with MACB times

Answer

NTFS $MFT entries contain four timestamps (Modified, Accessed, Changed, Born — MACB) offering the most granular file activity timeline.

Question 3

A network capture shows an internal host sending small UDP packets to many different external IPs on port 53 followed by unusually long responses. This pattern suggests:

Accepted Answer

DNS amplification attack or DNS tunneling exfiltration

Answer

Small queries with large responses to many external resolvers indicate DNS amplification; queries to one resolver with encoded data indicate DNS tunneling.

Question 4

During an IR engagement, you discover PowerShell scripts executed with the flag '-EncodedCommand'. What does this indicate?

Accepted Answer

Base64-encoded command execution to evade signature-based detection

Answer

The -EncodedCommand flag accepts Base64-encoded commands, a common technique to bypass string-based detection rules in security tools.

Question 5

Which artifact is MOST useful for determining whether a file was executed on a Windows system even if the file has since been deleted?

Accepted Answer

Windows Prefetch files (.pf)

Answer

Windows Prefetch files record execution evidence including the executable name, run count, and last run times, persisting after the original file is deleted.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Incident Response and Forensics 3