GIAC GCFA Practice Test

GCFA practice test: what's covered

• Windows Forensics
• NTFS Artifacts
• Memory Forensics
• Timeline Analysis
• Threat Hunting
• Anti-Forensics

Free GCFA sample questions

1. During the scoping phase of a confirmed enterprise breach, the IR lead wants to quickly determine the full set of systems an adversary touched before pulling images. Which approach best fits a modern enterprise-scale hunt over hundreds of endpoints?

   • A. Sweep for a small set of high-fidelity indicators (file hashes, persistence keys, service names) across all hosts using an EDR/remote-collection tool, then pivot
   • B. Forensically image every endpoint sequentially with a write blocker before any analysis
   • C. Power off all suspect hosts immediately to preserve disk state
   • D. Rely solely on the SIEM dashboard counts and declare scope from alert volume
   Show answer

   Correct: A. Enterprise scoping uses targeted, scalable indicator sweeps (IOCs/IOAs) across the fleet to find lateral spread fast, then drills into the hits. Imaging everything first is far too slow, and powering hosts off destroys volatile memory/network state needed to scope the intrusion.

2. An analyst maps observed adversary behavior to a framework so the team can reason about gaps in detection coverage and predict the attacker's next likely techniques. Which framework is purpose-built for classifying adversary tactics and techniques across the kill chain?

   • A. MITRE ATT&CK
   • B. OWASP Top 10
   • C. CVSS v3.1
   • D. NIST CSF Identify function
   Show answer

   Correct: A. MITRE ATT&CK organizes real-world adversary behavior into tactics (the why) and techniques (the how), which is exactly what threat hunters use to map activity and find coverage gaps. OWASP/CVSS describe app vulnerabilities and severity, not adversary TTPs.

3. Hunting for lateral movement, an analyst finds Security Event ID 4624 with Logon Type 3 originating from an internal host, immediately followed by Service Control Manager Event ID 7045 installing a service with a random-looking name. Which technique is this pattern most consistent with?

   • A. Remote service creation for lateral movement (e.g., PsExec-style execution)
   • B. An interactive console logon by a help-desk technician
   • C. A scheduled Windows Update installing a driver
   • D. A normal Kerberos ticket-granting renewal
   Show answer

   Correct: A. A network logon (4624 Type 3) paired with a freshly installed service (7045) bearing a random name is the classic PsExec/remote-service-execution footprint used to move laterally. Interactive logons are Type 2, and update/Kerberos activity does not register random-named services this way.

4. Investigating credential theft on a compromised workstation, the team suspects the adversary dumped hashes and tickets from memory. Which on-disk and in-memory artifacts most directly indicate LSASS credential extraction by a tool such as Mimikatz?

   • A. lsass.exe being accessed/dumped (e.g., a process opening LSASS with read rights or an lsass dump file) plus sekurlsa-style module activity
   • B. A spike in DNS cache entries for internal hosts
   • C. An increase in Prefetch files for notepad.exe
   • D. New entries in the Windows Firewall log for outbound HTTPS
   Show answer

   Correct: A. Credential theft tooling reads LSASS memory (or creates an LSASS dump) to extract plaintext, NTLM hashes and Kerberos tickets, so suspicious LSASS access and dump artifacts are the direct evidence. DNS cache, Prefetch for notepad, and firewall HTTPS entries are not specific to credential dumping.

5. An IR team formalizes its process so evidence is handled consistently and the response is repeatable. Which ordering reflects the widely taught incident response lifecycle?

   • A. Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned
   • B. Containment → Preparation → Recovery → Identification → Eradication
   • C. Identification → Recovery → Containment → Preparation → Eradication
   • D. Eradication → Identification → Lessons Learned → Containment → Recovery
   Show answer

   Correct: A. The SANS/NIST IR lifecycle proceeds Preparation, Identification (detection/analysis), Containment, Eradication, Recovery, then Lessons Learned. The other orderings break the dependency chain — you cannot recover before containing or eradicate before identifying.

Last updated: 2026-10-19

GCFA practice test FAQ

Related practice tests

• GIAC GCIA practice test
• GIAC GCIH practice test
• GIAC GPEN practice test