GCIA Incident Response and Forensics 4

Question 1

A forensic analyst examines a Linux system and finds entries in /proc/[pid]/maps showing memory regions marked 'rwx'. Why is this significant?

Accepted Answer

Regions with read-write-execute permissions may contain injected shellcode

Answer

This is normal for shared libraries loaded by processes

Answer

It indicates the process is using encrypted memory

Answer

rwx regions are standard for JIT-compiled applications only

Question 2

During threat hunting, an analyst finds a process named 'svch0st.exe' running from C:\Users\Public\. What evasion technique does this represent?

Accepted Answer

Masquerading — using a name similar to a legitimate Windows process but running from an abnormal path

Answer

Process hollowing of the real svchost.exe binary

Answer

DLL side-loading via a legitimate application

Answer

Token impersonation using svchost privileges

Question 3

In network forensics, which pcap filter expression would isolate only DNS query responses containing more than 10 resource records?

Accepted Answer

dns.count.answers > 10

Answer

tcp.port == 53

Answer

dns.flags.response == 1

Answer

udp.length > 512

Question 4

An IDS analyst sees HTTP traffic with a URI containing '%2527' — double URL encoding of a single quote. This is MOST likely an attempt to:

Accepted Answer

Bypass input validation filters that decode only once before checking

Answer

Exploit a buffer overflow via HTTP headers

Answer

Perform directory traversal using encoded slashes

Answer

Conduct a CSRF attack via encoded parameters

Question 5

During a Windows forensics examination, which artifact would reveal applications that were installed and subsequently uninstalled from the system?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall combined with event log 11707

Answer

Windows Prefetch directory C:\Windows\Prefetch

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Answer

$MFT records in NTFS

Question 6

An analyst is conducting a live forensic acquisition and needs to capture RAM without writing to the suspect's disk. Which method is MOST appropriate?

Accepted Answer

Use a trusted bootable USB with WinPmem to write the dump to a separate forensic drive

Answer

Hibernate the system to create a hiberfil.sys memory snapshot

Answer

Run Task Manager and use the 'Create dump file' option

Answer

Pull the power cord to preserve volatile memory state

Question 7

Which field in a Zeek (formerly Bro) conn.log would an analyst examine to identify long-duration encrypted sessions that may indicate a persistent C2 channel?

Accepted Answer

duration

Answer

orig_bytes

Answer

service

Answer

history