GCFA Memory Forensics & Volatile Data Analysis

Question 1

Which Volatility plugin is used to list running processes from a Windows memory image?

Accepted Answer

pslist

Answer

proclist

Answer

tasklist

Answer

procview

Question 2

What is the primary purpose of acquiring a memory dump before shutting down a compromised system?

Accepted Answer

To preserve running process state and volatile artifacts that would be lost on power-off

Answer

To create a backup of the operating system

Answer

To capture the file system in a forensically sound manner

Answer

To document network configurations permanently

Question 3

Which data structure in Windows does Volatility's 'pstree' plugin use to build a parent-child process hierarchy?

Accepted Answer

EPROCESS InheritedFromUniqueProcessId field

Answer

PEB (Process Environment Block)

Answer

VAD (Virtual Address Descriptor)

Answer

KTHREAD structure

Question 4

What technique do rootkits use to hide processes from tools that enumerate the EPROCESS doubly-linked list?

Accepted Answer

DKOM (Direct Kernel Object Manipulation)

Answer

DLL injection

Answer

Code caving

Answer

APC injection

Question 5

Which Volatility plugin can detect processes hidden via DKOM by scanning memory for EPROCESS pool tags instead of walking linked lists?

Accepted Answer

psscan

Answer

pslist

Answer

pstree

Answer

cmdline

Question 6

In memory forensics, what does the acronym VAD stand for, and what is its primary use?

Accepted Answer

Virtual Address Descriptor — tracks memory regions allocated to a process

Answer

Volatile Artifact Database — stores forensic artifacts

Answer

Virtual Address Directory — maps kernel addresses

Answer

Volatile Address Dictionary — maps DLL base addresses

Question 7

Which memory forensics indicator most strongly suggests code injection into a legitimate process?

Accepted Answer

An executable memory region that is not backed by a file on disk (MEM_PRIVATE + PAGE_EXECUTE)

Answer

A process with a high handle count

Answer

A process with many open network sockets

Answer

A DLL loaded from System32