GX-FA exam questions

1. Question 1

   Single answer

   In a forensic analysis, the “%SystemRoot%\Prefetch” directory is examined primarily to discover:

   • A

     Deleted registry keys

   • B

     Executable files that have been run recently

   • C

     Network share mappings

   • D

     User password hashes

   Reveal answer

   Correct answer

   • B

     Executable files that have been run recently

   Explanation

   Prefetch files are created when an executable runs, storing metadata about the execution, helping investigators identify recently used programs.

2. Question 2

   Single answer

   Which of the following tools can be used to extract and parse Windows Event Log (EVTX) files into CSV format?

   • A

     Evtxtract

   • B

     RegRipper

   • C

     MFTExp

   • D

     Bulk Extractor

   Reveal answer

   Correct answer

   • A

     Evtxtract

   Explanation

   Evtxtract (or its Python counterpart) reads EVTX files and can export events to CSV for analysis.

3. Question 3

   Single answer

   The “lsass.exe” process typically runs under which user account?

   • A

     Local System

   • B

     Network Service

   • C

     Local Service

   • D

     Administrator

   Reveal answer

   Correct answer

   • A

     Local System

   Explanation

   LSASS runs under the Local System account because it must access secure system resources for authentication

4. Getting the hang of it? 135 more GX-FA questions are waiting, each with its answer. Unlock them all

5. Question 4

   Single answer

   Which of the following is a characteristic of a “sandbox escape” technique often observed in advanced malware?

   • A

     Use of standard Windows APIs only

   • B

     Exploiting virtualization driver flaws to gain host OS control

   • C

     Deleting all Prefetch files

   • D

     Modifying the user’s desktop wallpaper

   Reveal answer

   Correct answer

   • B

     Exploiting virtualization driver flaws to gain host OS control

   Explanation

   Sandbox escapes frequently target vulnerabilities in virtualization drivers (e.g., VMware, Hyper-V) to break out of the isolated environment.

6. Question 5

   Single answer

   The “Amcache.hve” hive is located in which directory on a Windows system?

   • A

     %SystemRoot%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Apps\Amcache.hve

   • B

     %SystemRoot%\System32\config\Amcache.hve

   • C

     %SystemRoot%\AppCompat\Programs\Amcache.hve

   • D

     %SystemRoot%\System32\winevt\Logs\Amcache.hve

   Reveal answer

   Correct answer

   • C

     %SystemRoot%\AppCompat\Programs\Amcache.hve

   Explanation

   The Amcache.hve file resides in the “AppCompat\Programs” folder under the Windows directory.

7. Question 6 Locked Unlock to see this question
8. Question 7 Locked Unlock to see this question

Back to the GX-FA exam page