Windows Memory and Artifact Analysis DFE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is examining a memory dump from a Windows 10 machine. The analyst suspects that a malware process is hiding its network connections by using a rootkit. The analyst also needs to determine if the malware modified the registry to achieve persistence. Which Volatility plugins should the analyst use in combination to confirm both the hidden network connections and the registry modification?

   • Apslist to list processes and dlllist to list loaded DLLs
   • Bmalfind to detect injected code and svcscan to list services
   • Cnetscan to enumerate network connections and printkey to dump registry keys
   • Dpstree to show process hierarchy and envars to list environment variables
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of Windows event logs in forensic analysis?

   • ATo encrypt user data on the hard drive.
   • BTo store copies of all files opened by users.
   • CTo replace the need for memory forensics.
   • DTo provide a chronological record of system and security events.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A forensic investigator is called to a scene where a Windows system is running and the suspect is still logged in. The investigator needs to preserve evidence of the current state of the system, including running processes and network connections. Which tool should be used to acquire this volatile data?

   • AA memory acquisition tool like FTK Imager or WinPmem
   • BA disk imaging tool like dd or FTK Imager
   • CA network capture tool like Wireshark
   • DA file system analysis tool like Autopsy
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic examiner is analyzing a Windows 10 system and needs to determine which user accounts were created recently, what programs were installed, and whether any files were deleted from the system drive. Which combination of artifact locations should the examiner prioritize?

   • APagefile.sys, Hiberfil.sys, and Swapfile.sys
   • BRegistry hives (SAM, SOFTWARE, NTUSER.DAT), the $MFT, and the Recycle Bin
   • CBrowser history, LNK files, and Recent Documents
   • DEvent logs (Security, System), Prefetch files, and Shimcache
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is investigating a user's activity on a Windows system and needs to determine which documents the user opened. Which user activity artifact should be examined?

   • ALNK files in the user's Recent folder
   • BThe Security event log
   • CThe $MFT
   • DThe Windows Prefetch folder
   Reveal Solution Discussion Select an answer first