GCIA Incident Response and Forensics 4

Question 1

A forensic analyst examines a Linux system and finds entries in /proc/[pid]/maps showing memory regions marked 'rwx'. Why is this significant?

Accepted Answer

Regions with read-write-execute permissions may contain injected shellcode

Answer

Memory regions with rwx permissions are suspicious because they can both store and execute arbitrary code, a hallmark of shellcode injection.

Question 2

During threat hunting, an analyst finds a process named 'svch0st.exe' running from C:\Users\Public\. What evasion technique does this represent?

Accepted Answer

Masquerading — using a name similar to a legitimate Windows process but running from an abnormal path

Answer

Masquerading involves naming malware similarly to legitimate processes (using lookalike characters like '0' for 'o') while running from non-standard paths.

Question 3

In network forensics, which pcap filter expression would isolate only DNS query responses containing more than 10 resource records?

Accepted Answer

dns.count.answers > 10

Answer

The Wireshark display filter 'dns.count.answers > 10' specifically targets DNS response packets with more than 10 answer records, useful for detecting DNS amplification.

Question 4

An IDS analyst sees HTTP traffic with a URI containing '%2527' — double URL encoding of a single quote. This is MOST likely an attempt to:

Accepted Answer

Bypass input validation filters that decode only once before checking

Answer

Double encoding (%25 = %, so %2527 decodes first to %27 then to ') bypasses WAFs or filters that only URL-decode input once before applying security checks.

Question 5

During a Windows forensics examination, which artifact would reveal applications that were installed and subsequently uninstalled from the system?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall combined with event log 11707

Answer

The Uninstall registry key combined with Event ID 11707 (MsiInstaller product removed) provides evidence of applications that were once present but subsequently removed.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Incident Response and Forensics 4