A forensic team is responding to a ransomware incident on a Windows server. The server is still running, but the ransomware is actively encrypting files. The team must acquire memory to identify the ransomware process and its command-and-control communication. However, the acquisition process itself may trigger the ransomware to delete itself or cause further damage. Which approach best balances the need for evidence with the risk of further damage?

Power off the system immediately to stop the encryption

Isolate the system from the network first, then acquire memory

Wait for the encryption to complete before acquiring memory

Acquire memory immediately using a trusted tool, then isolate the system from the network

A forensic analyst is acquiring memory from a system that is suspected of running a memory-scraping malware. The analyst notices that the system's pagefile is heavily used. What is the implication for memory forensics?

The pagefile will contain a complete copy of RAM.

Some volatile data may have been paged out to disk and is not in the RAM dump.

The memory dump will be larger than the physical RAM size.

The memory dump will be encrypted because of the pagefile.

An incident responder is analyzing a memory dump from a compromised Linux server. The goal is to determine if an attacker ran a cryptocurrency miner. Which memory analysis artifact would provide the most direct evidence of this activity?

A list of running processes and their command-line arguments.

The contents of the /etc/passwd file from the disk image.

The contents of the browser history cache.

During a memory analysis, an examiner notices that a known malware process is not visible in the process list, but network connections to a known command-and-control server are present. What is the most likely explanation?

The malware is using process hollowing or direct kernel object manipulation to hide.

The memory dump was taken after the malware had already exited.

The malware is stored only on disk and not in memory.

The memory dump is corrupted and missing process data.

A forensic analyst is documenting the evidence collection process for a case. The analyst needs to explain why certain data must be collected before the system is powered off. Which statement correctly describes the volatility of data?

Data in the CPU cache is non-volatile

Data on the hard drive is more volatile than data in RAM

Network connections are non-volatile and persist after power-off

Data in RAM is volatile and is lost when the system is powered off

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 5)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 21–25

21expert · hard
A forensic team is responding to a ransomware incident on a Windows server. The server is still running, but the ransomware is actively encrypting files. The team must acquire memory to identify the ransomware process and its command-and-control communication. However, the acquisition process itself may trigger the ransomware to delete itself or cause further damage. Which approach best balances the need for evidence with the risk of further damage?
Select an answer first
22expert · hard
A forensic analyst is acquiring memory from a system that is suspected of running a memory-scraping malware. The analyst notices that the system's pagefile is heavily used. What is the implication for memory forensics?
Select an answer first
23application · medium
An incident responder is analyzing a memory dump from a compromised Linux server. The goal is to determine if an attacker ran a cryptocurrency miner. Which memory analysis artifact would provide the most direct evidence of this activity?
Select an answer first
24application · hard
During a memory analysis, an examiner notices that a known malware process is not visible in the process list, but network connections to a known command-and-control server are present. What is the most likely explanation?
Select an answer first
25application · medium
A forensic analyst is documenting the evidence collection process for a case. The analyst needs to explain why certain data must be collected before the system is powered off. Which statement correctly describes the volatility of data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.