An analyst is examining a memory image from a machine that was used to browse a phishing site. Which memory artifact would best help identify the URL that was visited?

The browser's process memory, which may contain the URL in strings or heap data.

The Master File Table (MFT) from the disk.

The system's registry hives from the disk.

The system's event logs from the disk image.

What is the primary purpose of memory forensics in a digital investigation?

To preserve the integrity of files on a storage device by creating a bit-for-bit copy

To analyze the contents of a system's RAM to find evidence of running processes, network activity, and malware

To identify the physical location of a suspect's computer on a network

To recover deleted files from a hard disk drive

Which of the following is an example of volatile data that would be lost when a computer is powered off?

The Master Boot Record (MBR) of the system disk

The list of currently running processes and their memory addresses

The contents of a file stored on an NTFS volume

The system's hostname stored in the registry

In a digital investigation, why is memory forensics considered valuable even when a full disk image is available?

It is faster than analyzing a disk image because RAM is smaller

It provides a permanent record of all files ever stored on the system

It can recover data that was never written to disk, such as decrypted passwords and in-memory malware

It eliminates the need to analyze the disk image

A memory dump from a compromised web server shows a process named 'svchost.exe' running from a non-standard path. What does this indicate?

The process is a kernel-mode driver.

The process may be masquerading as a legitimate system process.

The process is a third-party application that uses the same name.

The process is a normal Windows service host.

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 1)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1application · medium
An analyst is examining a memory image from a machine that was used to browse a phishing site. Which memory artifact would best help identify the URL that was visited?
Select an answer first
2foundation · easy
What is the primary purpose of memory forensics in a digital investigation?
Select an answer first
3foundation · easy
Which of the following is an example of volatile data that would be lost when a computer is powered off?
Select an answer first
4foundation · easy
In a digital investigation, why is memory forensics considered valuable even when a full disk image is available?
Select an answer first
5application · medium
A memory dump from a compromised web server shows a process named 'svchost.exe' running from a non-standard path. What does this indicate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.