GCFA Introduction to Memory Forensics Practice Test 2 — 15 Questions

Question 1

When analyzing memory for evidence of code injection, which THREE of the following memory regions or indicators are most significant to investigate?

Accepted Answer

Memory segments marked as PAGE_EXECUTE_READWRITE. Code injection often involves modifying existing memory segments or creating new ones with abnormal permissions. Analysts must look for areas of memory that are marked as executable but do not map to a file on disk (private memory), detect hooks in common system libraries, or identify discrepancies between memory-resident code and the original binary on disk. These indicators are classic signs that a process has been tampered with to execute malicious logic.

Answer

The presence of standard DLLs in the loading list

Answer

The thread environment block (TEB) memory region

Question 2

Refer to the exhibit. An examiner discovers the VAD entry shown in the exhibit for a process. What is the most appropriate forensic conclusion regarding this memory segment?

Accepted Answer

The memory segment is a malicious injection. The combination of PAGE_EXECUTE_READWRITE protection and the absence of an associated file (File: None) is a classic indicator of malicious code injection. Normal applications rarely allocate memory that is simultaneously writable and executable, as this violates standard security practices like Data Execution Prevention (DEP). The lack of a file-backing suggests the code resides entirely in memory, a common technique for fileless malware to avoid detection by traditional on-disk antivirus scanners.

Answer

The memory segment is a standard heap allocation

Answer

The memory segment is a legitimate shared library

Answer

The memory segment is part of the system kernel

Question 3

When identifying a hidden process via a cross-view analysis, which memory structure is most reliable to compare against the EPROCESS list?

Accepted Answer

The thread list in the scheduler. Cross-view analysis involves comparing the results of different enumeration methods to find inconsistencies. While the EPROCESS list (ActiveProcessLinks) is easily manipulated by rootkits to hide processes, the thread-based enumeration is much harder to hide, as the Windows scheduler must be aware of every thread to execute it. By iterating through all threads in the system, an analyst can identify processes that are excluded from the primary link list but are still actively executing.

Answer

The Master File Table (MFT)

Answer

The user-mode Process Environment Block (PEB)

Answer

The System Service Descriptor Table (SSDT)

Question 4

An examiner suspects that a system has been compromised with a rootkit that hooks kernel functions. Which memory forensics technique is most appropriate to detect this?

Accepted Answer

Verifying the SSDT function pointers. Kernel hooks are a common rootkit tactic used to intercept system calls and hide malicious files, network connections, or processes. By performing integrity checks on the System Service Descriptor Table (SSDT) or the Interrupt Descriptor Table (IDT), an analyst can identify function pointers that point outside the expected range of the kernel's memory space, which is a clear indicator of malicious redirection and rootkit activity.

Answer

Analyzing the process environment block (PEB)

Answer

Enumerating all running threads

Answer

Scanning for file system changes in the MFT

Question 5

Which of the following describes the purpose of the 'Object Header' in Windows memory forensics?

Accepted Answer

It contains metadata like reference counts and types. The Object Header precedes the body of every object managed by the Windows kernel, such as processes, threads, or files. It contains critical metadata, including the object type, reference count, and security descriptor. For forensic analysts, this header provides vital information about the object's lifespan and permissions, which is crucial for identifying unauthorized access or tracking the lifecycle of malicious objects within the kernel's memory management system.

Answer

It stores the process command line arguments

Answer

It is used for memory page table translations

Answer

It provides a mapping for disk-based sectors

Question 6

Refer to the exhibit. What is the most significant finding based on the Volatility 'malfind' output?

Accepted Answer

The process has been infected via code injection. The presence of the 'MZ' header (the magic bytes for a Windows PE executable) in a memory region that is not backed by a file on disk (VadS) and is marked as PAGE_EXECUTE_READWRITE is definitive proof of an injected executable. The malware has loaded a complete, valid PE file directly into memory to run its payload, which is a classic indicator of advanced fileless malware that bypasses file-system-based security controls.

Answer

The process is running a standard, signed driver

Answer

The process is using a standard heap allocation

Answer

The memory segment is a legitimate shared DLL

Question 7

Why does the use of 'DKOM' (Direct Kernel Object Manipulation) by rootkits pose a significant challenge for traditional forensic tools that rely on the Windows API?

Accepted Answer

It hides the process by unlinking it from the process list. Traditional tools rely on the Windows API to list processes and threads. These APIs query the kernel's process list (ActiveProcessLinks). DKOM allows a rootkit to unlink a process from this list while leaving the process structure intact so it can still be scheduled for execution. Because the API only reports what the kernel's linked list reveals, the hidden process effectively disappears from standard tools, requiring forensic analysts to use memory-parsing techniques.

Answer

It encrypts the entire memory dump

Answer

It prevents the acquisition of the memory dump

Answer

It modifies the CPU instructions directly

Question 8

Which memory artifact is most useful for identifying the specific user account associated with a suspicious process?

Accepted Answer

The process security token. In Windows, every process is associated with a security token object that defines the user's identity, privileges, and groups. By extracting the security token structure associated with an EPROCESS object in memory, an analyst can determine the exact user context under which the process is executing. This is vital for determining if a process was launched with system privileges or by a compromised local user account during an incident.

Answer

The thread environment block (TEB)

Answer

The process environment block (PEB)

Answer

The registry hive file for the user

Question 9

You are analyzing a memory dump using Volatility. You suspect a rootkit has hooked the SSDT. Which memory structure is primarily accessed to verify system service dispatching integrity?

Accepted Answer

SSDT (System Service Descriptor Table). The System Service Descriptor Table (SSDT) maps system calls to kernel-mode functions. Rootkits often modify these pointers to intercept process execution. By comparing the SSDT addresses against the kernel's base image, analysts can identify unauthorized redirections. This is crucial for detecting stealthy malware that hides its presence by manipulating the standard system call flow, ensuring the integrity of core operating system operations.

Answer

IDT (Interrupt Descriptor Table)

Answer

GDT (Global Descriptor Table)

Answer

PTE (Page Table Entry)

Question 10

Which TWO of the following are considered reliable methods for detecting hidden processes in memory forensics?

Accepted Answer

psscan pool tag analysis. Detecting hidden processes requires comparing results from multiple analysis techniques. Traversing linked lists (pslist) is easily bypassed, so analysts use pool tag scanning (psscan) and cross-referencing with other structures like the Handle Table. These methods are critical because they bypass standard OS reporting mechanisms, ensuring that malware hiding via DKOM or other techniques is identified by looking at the raw physical memory contents directly.

Answer

pslist enumeration

Answer

Task Manager API polling

Answer

Registry hive parsing

Question 11

When analyzing a memory dump, what is the primary purpose of identifying the 'KPCR' (Kernel Processor Control Region)?

Accepted Answer

To find the current thread context.. The KPCR is a structure containing critical processor-specific information, including the current thread and CPU state. It is vital for forensic analysts because it serves as the anchor for finding the current thread of execution on each core. Understanding the KPCR helps analysts reconstruct the execution context, which is essential for identifying which threads were running at the moment of capture, especially during complex multi-threaded attacks.

Answer

To identify all running processes.

Answer

To map virtual addresses to physical pages.

Answer

To reset kernel-mode security policies.

Question 12

Which THREE items are typically stored in a thread's TEB (Thread Environment Block)?

Accepted Answer

Thread Local Storage (TLS) pointers. The TEB is a user-mode structure that maintains thread-specific data, including the Thread Local Storage (TLS) array, exception handling chains, and the stack base/limit. Accessing the TEB is essential for forensic analysts because it helps decode how a specific thread executes, allows for the reconstruction of thread-local malware behavior, and provides insights into how the application manages its execution environment and exception handling.

Answer

Active process list pointer

Answer

Kernel-mode privilege level

Question 13

In the context of memory forensics, what does the term 'Page File' represent in a crash dump?

Accepted Answer

A file that stores inactive virtual memory.. The page file is a disk-based extension of physical RAM. When a system performs a dump, it may contain data swapped from physical memory to the page file. Forensic analysts must understand this because critical evidence—such as decrypted payloads or old process data—might exist in the page file rather than the active physical RAM, requiring the analyst to reconstruct the virtual address space using both sources.

Answer

A reserved section of the CPU cache.

Answer

A list of all allocated kernel drivers.

Answer

A log of all system process launches.

Question 14

Which Volatility plugin is best suited to identify injected code that resides in unbacked memory regions?

Accepted Answer

malfind. The 'malfind' plugin scans memory for regions that are marked as executable (X) but are not backed by a file on disk (VAD tags). This is the standard method for finding shellcode or injected DLLs, which are common in fileless malware. It matters because attackers often use memory injection to bypass signature-based antivirus, and detecting these unbacked regions is the primary way to uncover such hidden malicious execution.

Answer

pslist

Answer

handles

Answer

dlllist

Question 15

In memory forensics, what is the role of the 'VAD' (Virtual Address Descriptor) tree?

Accepted Answer

To map virtual memory ranges for a process.. The VAD tree is a kernel structure used by the memory manager to keep track of the virtual memory ranges allocated to a process. It is essential for forensic analysts because it defines the memory map of a process, including which areas are executable, read-only, or writable. This structure is critical for identifying memory-resident threats that attempt to hide their presence by manipulating memory permissions to execute malicious code.

Answer

To store the process execution priority.

Answer

To log all network connections made.

Answer

To secure the process against buffer overflows.