Introduction to Memory Forensics GCFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium · select all that apply

   A memory analyst is examining a memory image from a compromised server. Which of the following are primary goals of memory analysis? Select all that apply.

   • ARecovering deleted files from the filesystem
   • BDetermining the system's hardware configuration
   • CIdentifying running processes
   • DDetecting malware
   • EIdentifying network connections
   Check answers Discussion Select an answer first
2. 17application · medium

   A forensic examiner is explaining to a client why memory forensics is necessary even though a full disk image was already taken. Which statement best describes the unique value of memory forensics?

   • AIt can recover deleted files from the hard drive.
   • BIt can recover ephemeral artifacts like running processes and network connections that are not on disk.
   • CIt provides a complete backup of all files on the system.
   • DIt is faster than disk imaging and requires no special tools.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is preparing to collect evidence from a live Windows server. The examiner wants to ensure that the most volatile data is collected first. Which of the following lists the data sources in the correct order from most volatile to least volatile?

   • ARAM, network connections, disk files, backup tapes
   • BNetwork connections, RAM, disk files, backup tapes
   • CBackup tapes, disk files, network connections, RAM
   • DDisk files, RAM, network connections, backup tapes
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic analyst is called to a site where a server is suspected of being compromised. The server is running critical production services and cannot be shut down. The analyst must acquire memory while minimizing disruption. Which approach best balances forensic soundness and operational continuity?

   • AUse a trusted memory acquisition tool on the live system and verify the hash of the resulting dump.
   • BCopy the pagefile.sys file from the disk.
   • CPerform a hard power-off and then image the physical memory chip.
   • DRun a network packet capture on the server's interface.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of data is typically found in a memory image but NOT in a traditional disk image?

   • AThe contents of the Windows registry hive files
   • BThe file allocation table of a FAT32 partition
   • CThe plaintext of a password that was entered by the user and is still cached in RAM
   • DDeleted files that have been overwritten
   Reveal Solution Discussion Select an answer first