A security analyst suspects a memory-resident malware infection on a Windows workstation. The analyst needs to identify running processes and their network connections without touching the disk. Which tool and technique should be used?

Run Task Manager on the live system to list processes and network connections.

Use Volatility to analyze a memory dump acquired with a tool like WinPmem or DumpIt.

Use the Windows Event Log to find process creation events and network connections.

Use netstat -ano on the live system to list network connections.

A forensic investigator needs to preserve a Windows 10 laptop's hard drive as evidence. The investigator must ensure the original drive is not altered and that the acquired image is a bit-for-bit copy. Which procedure should be used?

Use the Windows 'chkdsk' utility to check the drive for errors before imaging.

Boot the laptop to a write-blocker-enabled forensic environment and use FTK Imager to create a raw image, then verify the image's SHA-256 hash matches the original drive's hash.

Boot the laptop normally and use the built-in Backup and Restore feature to create a system image to an external drive.

Copy all files from the drive to a network share using Windows Explorer, then compare file sizes.

During a forensic examination of an NTFS drive, you discover a file with an alternate data stream (ADS). What is the most important reason to investigate this ADS?

ADSs contain the file's access control list (ACL).

ADSs are used to store the file's MFT entry.

ADSs are required for the file to be indexed by Windows Search.

ADSs can hide malicious code or data that is not visible in normal directory listings.

What is an Alternate Data Stream (ADS) in NTFS?

A type of file compression used by NTFS

A security descriptor that controls access to a file

A feature that allows a file to have multiple data streams, which can be used to hide data

A backup copy of the file stored in the $LogFile

GIAC Security Essentials

Domain 4Objective 7

Windows Automation, Auditing, and Forensics GSEC Practice Questions (Page 8)

Part of the Endpoint and Platform Security domain, which makes up ~32% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~30–51 in this domain), expect 3–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

10concepts

Questions 36–40

36application · medium
A security analyst suspects a memory-resident malware infection on a Windows workstation. The analyst needs to identify running processes and their network connections without touching the disk. Which tool and technique should be used?
Select an answer first
37application · medium
A forensic investigator needs to preserve a Windows 10 laptop's hard drive as evidence. The investigator must ensure the original drive is not altered and that the acquired image is a bit-for-bit copy. Which procedure should be used?
Select an answer first
38foundation · easy
An administrator needs to enforce a consistent security baseline across all Windows workstations in a domain. Which Windows automation feature is most appropriate for centrally applying these settings?
Select an answer first
39application · medium
During a forensic examination of an NTFS drive, you discover a file with an alternate data stream (ADS). What is the most important reason to investigate this ADS?
Select an answer first
40foundation · easy
What is an Alternate Data Stream (ADS) in NTFS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.