CDFI Memory Forensics & Volatile Data Analysis 2

Question 1

What is the EPROCESS structure in Windows memory forensics?

Accepted Answer

The kernel executive process object containing all metadata about a running process

Answer

A kernel structure storing active network connection metadata

Answer

A memory region holding cryptographic keys used by the Windows security subsystem

Answer

A data structure that caches Windows Registry hives in RAM

Question 2

What is Direct Kernel Object Manipulation (DKOM) and why is it forensically significant?

Accepted Answer

A rootkit technique that modifies kernel data structures to hide malicious processes or objects

Answer

A method for optimizing kernel memory allocation to improve performance

Answer

A forensic technique for safely examining live kernel memory

Answer

A Windows debugging API used for kernel-level crash analysis

Question 3

Which Volatility plugin best detects processes hidden by DKOM by scanning raw memory pool tags rather than walking linked lists?

Accepted Answer

psscan

Answer

pslist

Answer

pstree

Answer

cmdline

Question 4

What is the purpose of analyzing the Virtual Address Descriptor (VAD) tree in Windows memory forensics?

Accepted Answer

To map the virtual memory layout of a process and identify suspicious injected code regions

Answer

To reconstruct DNS query history stored in the DNS resolver cache

Answer

To recover deleted registry keys that have been unmapped from the hive

Answer

To enumerate active TCP/UDP connections associated with a process

Question 5

Which type of artifact found in memory forensics is generally NOT recoverable through disk-based forensic analysis?

Accepted Answer

Plaintext contents of encrypted volumes that are actively mounted

Answer

NTFS file timestamps and metadata

Answer

Master File Table (MFT) records for existing files

Answer

Deleted file fragments in unallocated disk clusters

Question 6

What can examining Master File Table (MFT) entries cached in memory reveal that may not be available through disk analysis alone?

Accepted Answer

File access patterns and recently accessed files providing additional timeline context

Answer

The current state of active TCP network connections

Answer

The list of currently logged-on user sessions

Answer

The complete Windows Security Event Log contents

Question 7

During memory analysis, a process has a Parent Process ID (PPID) pointing to a non-existent process. What does this most likely indicate?

Accepted Answer

A potential DKOM attack or a process spawned by malware that subsequently terminated to avoid detection

Answer

Normal Windows behavior that always occurs during system startup sequences

Answer

The process was launched from a Windows batch script or scheduled task

Answer

Normal behavior when Windows services are gracefully restarted