You are analyzing a memory image from a compromised server. You find a process named 'lsass.exe' that is making outbound HTTPS connections to a known malicious IP. The process's path is 'C:\Windows\System32\lsass.exe' and its parent is 'wininit.exe'. Which additional volatile artifact would best help you determine whether this is legitimate lsass.exe or a masquerading process?

Examine the process's environment variables and command line for unusual values.

Look at the process's start time and compare it to the system boot time.

Check the process's token for elevated privileges, because only SYSTEM can run lsass.exe.

Compare the process's memory sections (e.g., .text, .data) and loaded DLLs against a known-good baseline for lsass.exe.

An analyst is investigating a memory image from a system that was infected with ransomware. The analyst extracts the SYSTEM hive and finds a new service 'RansomSvc' with a start type of 0x0 (BOOT_START) and an image path of '\??\C:\Windows\System32\drivers\ransom.sys'. The analyst also finds a suspicious process 'ransom.exe' running from 'C:\Users\Public\'. Which artifact is most critical for understanding the ransomware's persistence mechanism?

The fact that the service is named 'RansomSvc'

The image path of the service pointing to a driver file

The service's start type of BOOT_START

The process 'ransom.exe' running from the Public folder

During an incident response, you acquire a memory image from a Windows workstation. You run a process listing and notice that the process 'svchost.exe' has a parent PID of 4 (System) but its path is 'C:\Users\Public\svchost.exe'. You also see a network connection from this process to an external IP on port 4444. Which volatile artifact combination would most directly confirm that this process is malicious and not a false positive?

Cross-reference the process's loaded DLL list and handle table with the network connection to identify injected code and the remote communication channel.

Check the registry Run key for a persistence entry that points to the same path, then reboot the system to see if the process reappears.

Verify that the process's parent is System, which proves it is a legitimate Windows service.

Compare the process's command line with the Windows Event Logs to see if it was started by a scheduled task.

During a memory forensics investigation, an analyst identifies a process 'spoolsv.exe' that is making an outbound connection to an IP address on port 445. The process's path is 'C:\Windows\System32\spoolsv.exe' and its parent is 'services.exe'. The analyst also finds that the process has a memory region with RWX permissions that is not backed by a file. What is the most likely conclusion?

The process is a legitimate system process that is using the network for Windows updates

The process is a legitimate system process that is using the network for print sharing

The process is a false positive from the memory analysis tool

The process has been injected with code that is using the network for lateral movement

Which memory artifact is most commonly used to detect code injection into a legitimate process, such as when malware allocates executable memory in a remote process?

Virtual Address Descriptors (VADs)

GIAC Certified Forensic Analyst

Domain 2Objective 2

Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 4)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 16–20

16application · medium
You are analyzing a memory image from a compromised server. You find a process named 'lsass.exe' that is making outbound HTTPS connections to a known malicious IP. The process's path is 'C:\Windows\System32\lsass.exe' and its parent is 'wininit.exe'. Which additional volatile artifact would best help you determine whether this is legitimate lsass.exe or a masquerading process?
Select an answer first
17expert · hard
An analyst is investigating a memory image from a system that was infected with ransomware. The analyst extracts the SYSTEM hive and finds a new service 'RansomSvc' with a start type of 0x0 (BOOT_START) and an image path of '\??\C:\Windows\System32\drivers\ransom.sys'. The analyst also finds a suspicious process 'ransom.exe' running from 'C:\Users\Public\'. Which artifact is most critical for understanding the ransomware's persistence mechanism?
Select an answer first
18application · medium
During an incident response, you acquire a memory image from a Windows workstation. You run a process listing and notice that the process 'svchost.exe' has a parent PID of 4 (System) but its path is 'C:\Users\Public\svchost.exe'. You also see a network connection from this process to an external IP on port 4444. Which volatile artifact combination would most directly confirm that this process is malicious and not a false positive?
Select an answer first
19expert · hard
During a memory forensics investigation, an analyst identifies a process 'spoolsv.exe' that is making an outbound connection to an IP address on port 445. The process's path is 'C:\Windows\System32\spoolsv.exe' and its parent is 'services.exe'. The analyst also finds that the process has a memory region with RWX permissions that is not backed by a file. What is the most likely conclusion?
Select an answer first
20foundation · easy
Which memory artifact is most commonly used to detect code injection into a legitimate process, such as when malware allocates executable memory in a remote process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 4)

Questions 16–20

Which memory artifact is most commonly used to detect code injection into a legitimate process, such as when malware allocates executable memory in a remote process?

Keep studying — Memory Forensics