Which of the following artifacts would a memory analyst look for to identify malware that does not write to disk?

Malicious entries in the Windows Event Log

Deleted files in the Recycle Bin

Malicious code injected into the memory space of a legitimate process

Suspicious strings in the Master File Table (MFT)

Which of the following is a common step in the basic process of acquiring memory from a live system?

Running a trusted memory acquisition tool on the live system to dump RAM to an external device

Powering off the system before capturing the memory image

Booting the system from a forensic CD to avoid altering the hard drive

Removing the RAM modules and reading them with a hardware programmer

An incident responder needs to acquire memory from a live Linux server that is running a critical production workload. The server has limited downtime tolerance, and the acquisition tool must minimize interference with the running system. Which approach best balances the need for evidence preservation with the operational constraints?

Use a trusted acquisition tool loaded from read-only media and write the memory image to a network share

Copy the contents of /proc and /sys to a USB drive

Power off the server and remove the physical memory modules for imaging

Run a memory acquisition tool installed on the server and save the image to the local hard drive

GIAC Certified Forensic Analyst

Domain 2Objective 1

Introduction to Memory Forensics GCFA Practice Questions (Page 9)

Part of the Memory Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 41–43

41foundation · easy
Which of the following artifacts would a memory analyst look for to identify malware that does not write to disk?
Select an answer first
42foundation · easy
Which of the following is a common step in the basic process of acquiring memory from a live system?
Select an answer first
43application · medium
An incident responder needs to acquire memory from a live Linux server that is running a critical production workload. The server has limited downtime tolerance, and the acquisition tool must minimize interference with the running system. Which approach best balances the need for evidence preservation with the operational constraints?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFA” is a trademark of its owner, used for identification only.

Introduction to Memory Forensics GCFA Practice Questions (Page 9)

Questions 41–43

Which of the following artifacts would a memory analyst look for to identify malware that does not write to disk?

Which of the following is a common step in the basic process of acquiring memory from a live system?

Keep studying — Memory Forensics