A forensic analyst is triaging a laptop that was found powered on but locked. The analyst needs to determine if the system was used to access a cloud storage account. Which type of data would be most useful and where would it be found?

Non-volatile data in the system's BIOS settings.

Volatile data in RAM, such as browser session tokens or cached credentials.

Non-volatile data in the hibernation file on disk.

Volatile data in the CPU cache.

How can anti-forensics techniques complicate memory analysis?

By encrypting the entire hard drive so that memory cannot be read

By making the system run faster so that memory is overwritten quickly

By hiding processes or injecting code into other processes to evade detection

By deleting the memory image file after acquisition

A forensic examiner is investigating a system that is suspected of being compromised by a rootkit. The rootkit is known to hide processes and network connections from the operating system. The examiner has a memory image of the system. Which approach is most likely to reveal the hidden processes?

Check the system's event logs for process creation events

Scan the disk for rootkit files

Use the system's built-in task manager to list processes

Use a memory analysis tool that scans for kernel data structures

Which of the following is a common challenge in memory forensics?

Memory forensics is only applicable to Windows systems

Memory analysis tools are unable to recover any useful data

Memory images are always too large to analyze

The data is highly volatile and can be lost if the system is powered off

What is the primary purpose of memory acquisition in a forensic investigation?

To permanently delete malicious code from the system

To create a bit-for-bit copy of the hard drive

To identify the IP address of the attacker

To capture the contents of RAM for later analysis without altering the live system

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 7)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 31–35

31application · medium
A forensic analyst is triaging a laptop that was found powered on but locked. The analyst needs to determine if the system was used to access a cloud storage account. Which type of data would be most useful and where would it be found?
Select an answer first
32foundation · easy
How can anti-forensics techniques complicate memory analysis?
Select an answer first
33expert · hard
A forensic examiner is investigating a system that is suspected of being compromised by a rootkit. The rootkit is known to hide processes and network connections from the operating system. The examiner has a memory image of the system. Which approach is most likely to reveal the hidden processes?
Select an answer first
34foundation · easy
Which of the following is a common challenge in memory forensics?
Select an answer first
35foundation · easy
What is the primary purpose of memory acquisition in a forensic investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.