An analyst is examining a memory image from a system that was infected with malware that uses a kernel driver for persistence. The analyst extracts the SYSTEM hive and finds a service named 'KernelSvc' with a start type of 0x1 (SYSTEM_START) and an image path of '\??\C:\Windows\System32\drivers\kernel.sys'. Which additional artifacts would help confirm that this driver is malicious? Select all that apply.

The driver's digital signature is invalid or missing

The driver file 'kernel.sys' is not present in the system's driver store

The service's start type is SYSTEM_START

The driver's image path is in the System32\drivers folder

An analyst is examining a memory image and uses a tool to list processes. The analyst notices that the process 'explorer.exe' has a memory region that is not backed by a file on disk and has RWX (read-write-execute) permissions. What should the analyst conclude from this finding?

The process is a system process that is using memory-mapped files

The process is likely running injected code

The process is a false positive from the memory analysis tool

The process is using a legitimate dynamic link library

You are analyzing a memory image from a Windows host. You extract the SOFTWARE registry hive and find a new value under 'Microsoft\Windows\CurrentVersion\Run' that points to 'C:\Users\Public\update.exe'. You also find a process named 'update.exe' running. Which registry artifact would you examine next to understand the persistence mechanism?

The 'AppInit_DLLs' value, which loads DLLs into every process.

The 'Winlogon' key, which controls the logon process.

The 'Image File Execution Options' key, which can be used for debugger hijacking.

The 'RunOnce' key, which may contain a one-time startup entry that also points to the same executable.

An analyst is examining a memory image from a system that is suspected of running keylogging malware. Which volatile artifact would be most directly relevant to confirming the keylogger's activity?

The process list, looking for a process with a suspicious name

The registry hives, looking for a new run key

The process's memory, looking for hooks on keyboard-related APIs

The network connections, looking for an outbound connection to a remote server

GIAC Certified Forensic Analyst

Domain 2Objective 2

Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 6)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

5concepts

Questions 26–30

26foundation · easy
Which memory forensics plugin or artifact would you use to list active TCP and UDP endpoints and associate them with the owning process ID?
Select an answer first
27expert · hard · select all that apply
An analyst is examining a memory image from a system that was infected with malware that uses a kernel driver for persistence. The analyst extracts the SYSTEM hive and finds a service named 'KernelSvc' with a start type of 0x1 (SYSTEM_START) and an image path of '\??\C:\Windows\System32\drivers\kernel.sys'. Which additional artifacts would help confirm that this driver is malicious? Select all that apply.
Select an answer first
28application · medium
An analyst is examining a memory image and uses a tool to list processes. The analyst notices that the process 'explorer.exe' has a memory region that is not backed by a file on disk and has RWX (read-write-execute) permissions. What should the analyst conclude from this finding?
Select an answer first
29application · medium
You are analyzing a memory image from a Windows host. You extract the SOFTWARE registry hive and find a new value under 'Microsoft\Windows\CurrentVersion\Run' that points to 'C:\Users\Public\update.exe'. You also find a process named 'update.exe' running. Which registry artifact would you examine next to understand the persistence mechanism?
Select an answer first
30application · medium
An analyst is examining a memory image from a system that is suspected of running keylogging malware. Which volatile artifact would be most directly relevant to confirming the keylogger's activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Analyzing Volatile Malicious Event Artifacts GCFA Practice Questions (Page 6)

Questions 26–30

Which memory forensics plugin or artifact would you use to list active TCP and UDP endpoints and associate them with the owning process ID?

An analyst is examining a memory image and uses a tool to list processes. The analyst notices that the process 'explorer.exe' has a memory region that is not backed by a file on disk and has RWX (read-write-execute) permissions. What should the analyst conclude from this finding?

An analyst is examining a memory image from a system that is suspected of running keylogging malware. Which volatile artifact would be most directly relevant to confirming the keylogger's activity?

Keep studying — Memory Forensics