Windows Memory and Artifact Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security analyst is investigating a Windows system that was compromised. The analyst has access to the Security event log and needs to determine if an attacker used a valid user account to log on remotely. Which event ID and logon type should be examined?

   • AEvent ID 4625 with Logon Type 3
   • BEvent ID 4624 with Logon Type 10
   • CEvent ID 4672 with Logon Type 4
   • DEvent ID 4634 with Logon Type 2
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which tool is commonly used to analyze Windows memory dumps and extract process, network, and registry information?

   • ANmap
   • BWireshark
   • CVolatility
   • DAutopsy
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An investigator is analyzing a Windows registry hive to determine which USB devices were connected to a workstation. Which registry key should be examined?

   • AHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
   • BHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • CHKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users
   • DHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is examining a memory dump from a Windows 10 system. The analyst suspects that a malware process is using a technique to hide its executable from the file system, and also that it modified the registry to disable Windows Defender. Which Volatility plugins would be most effective in confirming both the hidden process and the registry modification?

   • Apsscan to find hidden processes and envars to list environment variables
   • Bmalfind to detect injected code and svcscan to list services
   • Cpstree to show process hierarchy and dlllist to list loaded DLLs
   • Dpsxview to detect hidden processes and printkey to dump the Defender-related registry keys
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does a Prefetch file primarily indicate to a forensic examiner?

   • AThat a specific program was executed on the system.
   • BThe contents of the Recycle Bin.
   • CThe user's browsing history.
   • DThe network connections made by the system.
   Reveal Solution Discussion Select an answer first