During a memory analysis, an analyst finds a suspicious process that is not visible in the process list shown by the operating system's task manager. The analyst suspects the process is hidden by malware. Which memory analysis technique is most likely to reveal this hidden process?

Scanning the disk for malicious files

Reviewing the system's firewall logs

Checking the system's event logs for process creation events

Cross-referencing the process list with kernel data structures

A security analyst is explaining the value of memory forensics to a manager after a security incident. The manager asks, 'Why can't we just analyze the hard drive?' Which response best explains the unique value of memory forensics?

Memory forensics can capture data that is only present in RAM, such as running processes and unencrypted data

Memory forensics can recover deleted files from the disk

Memory forensics is required by law for all investigations

Memory forensics is faster than disk forensics

An incident responder is acquiring memory from a Windows system that has BitLocker enabled. The system is currently unlocked and running. What is the impact of BitLocker on memory acquisition?

BitLocker will encrypt the memory dump, making it unreadable.

BitLocker will cause the system to crash during acquisition.

BitLocker requires the analyst to enter the recovery key before acquisition.

BitLocker does not prevent memory acquisition because the system is running and the keys are in memory.

An incident responder is about to acquire memory from a Windows laptop that is running. The laptop has a USB port, and the responder has a forensic USB drive with acquisition tools. Which of the following is the most appropriate method for acquiring memory?

Boot the laptop from the USB drive and acquire memory

Use the laptop's built-in backup software to create a system image

Copy the contents of the laptop's hard drive to the USB drive

Run the acquisition tool from the USB drive while the laptop is running

A forensic team must acquire memory from a high-security server that is part of a critical infrastructure environment. The server is running a proprietary operating system, and the team has limited access to the physical console. The acquisition must be performed remotely without causing a system crash. Which approach is most appropriate?

Boot the server from a forensic live CD and acquire memory

Use the built-in task manager to list processes and save the output

Use a remote memory acquisition tool that supports the OS and send the image over an encrypted channel

Power off the server and remove the memory modules for offline imaging

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 2)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 6–10

6application · medium
During a memory analysis, an analyst finds a suspicious process that is not visible in the process list shown by the operating system's task manager. The analyst suspects the process is hidden by malware. Which memory analysis technique is most likely to reveal this hidden process?
Select an answer first
7application · medium
A security analyst is explaining the value of memory forensics to a manager after a security incident. The manager asks, 'Why can't we just analyze the hard drive?' Which response best explains the unique value of memory forensics?
Select an answer first
8application · medium
An incident responder is acquiring memory from a Windows system that has BitLocker enabled. The system is currently unlocked and running. What is the impact of BitLocker on memory acquisition?
Select an answer first
9application · medium
An incident responder is about to acquire memory from a Windows laptop that is running. The laptop has a USB port, and the responder has a forensic USB drive with acquisition tools. Which of the following is the most appropriate method for acquiring memory?
Select an answer first
10expert · hard
A forensic team must acquire memory from a high-security server that is part of a critical infrastructure environment. The server is running a proprietary operating system, and the team has limited access to the physical console. The acquisition must be performed remotely without causing a system crash. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.