A forensic analyst is investigating a case of intellectual property theft. The suspect's computer was found running, and the analyst needs to determine if any sensitive documents were accessed or transmitted. Which capability of memory forensics is most relevant to this investigation?

Identifying the user's social media accounts

Recovering deleted files from the hard drive

Recovering artifacts from running processes and network connections

Determining the system's BIOS version

A company's legal team asks a forensic examiner to determine if an employee used a USB drive to exfiltrate data. The employee's computer is still running. Which memory artifact would be most useful to answer this question?

The memory dump, which may contain the USB device's serial number and the process that accessed it.

The list of recently attached USB devices from the registry on disk.

Which of the following is a primary goal of memory analysis?

Recovering deleted emails from an email server

Calculating the hash value of a disk image

Determining the physical location of a server

Identifying running processes and their associated memory artifacts

A forensic analyst is asked to acquire memory from a system that is suspected of being compromised by rootkit that hooks the system call table. The analyst is using a memory acquisition tool that relies on the operating system's API. What is the primary risk?

The tool may crash the system due to the rootkit.

The tool may be redirected by the rootkit to capture incorrect memory.

The tool will not be able to access kernel memory.

The tool will require a reboot to complete.

An analyst is triaging a compromised Windows machine that is still powered on. The analyst wants to capture evidence of the attacker's current activities, including open files and network connections. Which of the following data sources is considered volatile and should be collected before the system is shut down?

The contents of the system's RAM

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 8)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 36–40

36application · medium
A forensic analyst is investigating a case of intellectual property theft. The suspect's computer was found running, and the analyst needs to determine if any sensitive documents were accessed or transmitted. Which capability of memory forensics is most relevant to this investigation?
Select an answer first
37application · medium
A company's legal team asks a forensic examiner to determine if an employee used a USB drive to exfiltrate data. The employee's computer is still running. Which memory artifact would be most useful to answer this question?
Select an answer first
38foundation · easy
Which of the following is a primary goal of memory analysis?
Select an answer first
39expert · hard
A forensic analyst is asked to acquire memory from a system that is suspected of being compromised by rootkit that hooks the system call table. The analyst is using a memory acquisition tool that relies on the operating system's API. What is the primary risk?
Select an answer first
40application · medium
An analyst is triaging a compromised Windows machine that is still powered on. The analyst wants to capture evidence of the attacker's current activities, including open files and network connections. Which of the following data sources is considered volatile and should be collected before the system is shut down?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.