GCFA Memory Forensics & Volatile Data Analysis 3

Question 1

Which Windows artifact stored in memory can reveal recently accessed network shares and mapped drives during a forensic investigation?

Accepted Answer

The NetBIOS cache and SMB session structures in memory

Answer

The MFT ($MFT)

Answer

The Windows prefetch files

Answer

The SAM registry hive

Question 2

What does the Volatility 'netscan' plugin enumerate from a Windows memory image?

Accepted Answer

Active and recently closed network connections, listening ports, and associated processes

Answer

DNS cache entries only

Answer

Firewall rule tables

Answer

SSL certificate stores

Question 3

During a memory analysis, an analyst finds a process named 'svchost.exe' with no parent process traceable to services.exe. What does this suggest?

Accepted Answer

Possible malware masquerading as svchost.exe, since legitimate instances are always spawned by services.exe

Answer

Normal behavior — svchost.exe can run independently

Answer

A Windows update process running in isolation

Answer

A process running in session 0 isolation

Question 4

What is the purpose of the Volatility 'dlllist' plugin in a forensic investigation?

Accepted Answer

Enumerates DLLs loaded into each process's address space from the PEB's InMemoryOrderModuleList

Answer

Lists all DLL files on the file system

Answer

Scans for unsigned DLLs globally

Answer

Compares DLL versions against a known-good baseline

Question 5

An analyst extracts a suspicious memory region using Volatility's 'malfind' and finds an MZ header followed by a PE structure. What is the recommended next forensic step?

Accepted Answer

Dump the PE from memory and submit it to a sandbox or perform static/dynamic malware analysis

Answer

Delete the extracted file immediately

Answer

Reboot the system to clear the injection

Answer

Check the Windows Event Log for the associated event ID

Question 6

Which concept describes the practice of loading a DLL directly from memory without touching the disk, commonly used by advanced malware to evade file-based detection?

Accepted Answer

Reflective DLL injection

Answer

DLL side-loading

Answer

AppInit_DLL persistence

Answer

COM hijacking

Question 7

When performing memory forensics on a 64-bit Windows system, which Volatility profile selection consideration is most critical for accurate analysis?

Accepted Answer

Matching the exact OS version and service pack (e.g., Win10x64_19041) to correctly interpret kernel data structures

Answer

The language pack installed on the system

Answer

The number of CPU cores on the target machine

Answer

The timezone setting of the operating system