GCFA Introduction to Memory Forensics Practice Test 3 — 15 Questions

Question 1

When inspecting a memory dump, you notice a process has a 'ParentProcessID' that does not exist in the process list. What does this suggest?

Accepted Answer

The process was likely orphaned by its parent.. A process with a non-existent parent ID often points to a 'orphaned' process, which is common when the parent process has already exited or was hidden. This is a red flag for malicious activity, as rootkits or malware often spawn sub-processes and then terminate the parent to hide the chain of execution. Identifying this is key to reconstructing the infection vector and timeline during a forensic investigation.

Answer

The process is a system idle thread.

Answer

The memory dump is corrupted.

Answer

The process is a legitimate background service.

Question 2

A forensic analyst captures a memory image from a Windows 10 workstation using a hardware acquisition tool. The analyst then wants to enumerate the loaded kernel modules to compare against a known-good baseline. Which Volatility 3 plugin should the analyst run to list the loaded kernel modules from the memory image?

Accepted Answer

windows.modules. The windows.modules plugin is designed to enumerate loaded kernel modules from a Windows memory image, providing a list of drivers and their base addresses. This is essential for comparing against a known-good baseline to identify unauthorized or malicious kernel modules. The other plugins target process lists, DLLs within processes, or handles, none of which directly provide a system-wide kernel module enumeration.

Answer

windows.dlllist

Answer

windows.handles

Answer

windows.pslist

Question 3

During a memory forensics investigation, an analyst observes a process with a parent process ID (PPID) that does not correspond to any active process in the windows.pslist output. The analyst suspects process injection or process hollowing. Which Volatility 3 plugin should the analyst use to identify processes that may be hidden from the active process list by comparing the linked list to a pool tag scan?

Accepted Answer

windows.psscan. windows.psscan uses pool tag scanning to locate EPROCESS structures in memory, which can uncover processes that have been unlinked from the active process list by rootkits or other hiding techniques. By comparing its output with windows.pslist, an analyst can identify discrepancies indicating hidden processes. The other plugins either rely on the active list or serve different purposes, such as command-line retrieval or network connection enumeration.

Answer

windows.netscan

Answer

windows.pstree

Answer

windows.cmdline

Question 4

A forensic analyst captures a memory image from a Windows 10 workstation suspected of malware infection. The analyst wants to quickly enumerate loaded kernel modules and compare them against the list of modules reported by the operating system to spot discrepancies. Which Volatility 3 plugin should the analyst use to list loaded kernel modules directly from the memory image?

Accepted Answer

windows.modules. The windows.modules plugin is designed to walk the kernel's loaded module list (PsLoadedModuleList) and display each module's name, base address, size, and path. This directly supports the analyst's goal of enumerating kernel modules from a memory image and comparing them against the operating system's reported list to identify discrepancies.

Answer

windows.svcscan

Answer

windows.dlllist

Answer

windows.driverscan

Question 5

An analyst is examining a memory dump from a Windows system infected with a rootkit that hooks the System Service Dispatch Table (SSDT). The analyst wants to identify which kernel functions have been hooked by comparing the SSDT entries to the original values. Which Volatility 3 plugin should the analyst use to detect SSDT hooks?

Accepted Answer

windows.ssdt. The windows.ssdt plugin specifically parses the System Service Dispatch Table and compares each service routine pointer to the expected function address within the owning kernel module. Discrepancies indicate hooks, often used by rootkits to intercept system calls. The other plugins focus on callbacks, IRP handlers, or device trees, none of which directly analyze the SSDT for hooked entries.

Answer

windows.driverirp

Answer

windows.devicetree

Answer

windows.callbacks

Question 6

An analyst is reviewing a Windows 10 memory image captured from a workstation suspected of malware infection. While examining a process, the analyst notices that the process's page directory base (DTB) points to a valid address, but the process's image path on disk cannot be found. Which Volatility 3 plugin should the analyst use to determine if the process memory contains injected code?

Accepted Answer

windows.malfind. The windows.malfind plugin is designed to detect injected code by scanning for memory regions that are executable but not backed by a file on disk. In this scenario, the process's image path is missing, which is a red flag for injection. Malfind would reveal such anomalies, helping the analyst confirm the presence of injected code. Other plugins like pslist, netscan, and cmdline do not perform this type of memory analysis.

Answer

windows.netscan

Answer

windows.pslist

Answer

windows.cmdline

Question 7

An incident responder acquires a memory image from a Windows Server 2016 system suspected of being compromised. The responder wants to identify network connections that were active at the time of capture, including the associated process names and ports. Which Volatility 3 plugin should the responder use to list active network connections from the memory image?

Accepted Answer

windows.netscan. In Volatility 3, the windows.netscan plugin is designed to scan memory for network connection structures, providing details such as local and remote addresses, ports, and owning process IDs. It works by pool tag scanning, which can uncover connections even if they are not in the active list. The other options are either Volatility 2 plugins or non-existent, making windows.netscan the correct choice.

Answer

windows.sockets

Answer

windows.netstat

Answer

windows.connections

Question 8

You are examining a Windows 10 memory image and need to determine whether a driver was loaded but subsequently unloaded, potentially concealing malicious activity. Which Volatility 3 plugin should you run to list previously loaded kernel modules that are no longer present in the active module list?

Accepted Answer

windows.modscan. To find drivers that were loaded and then unloaded, you need a plugin that scans kernel pool for module structures rather than relying on the active PsLoadedModuleList. windows.modscan performs exactly that pool scan and can recover residual module metadata, whereas the other plugins either list only active modules or focus on driver objects and IRP hooks, which would not reliably surface an unloaded driver.

Answer

windows.modules

Answer

windows.driverscan

Answer

windows.driverirp

Question 9

An analyst is examining a Windows 10 memory image with Volatility 3 and wants to list the loaded kernel modules along with their base addresses and sizes for comparison against a known-good baseline. Which Volatility 3 plugin should the analyst run?

Accepted Answer

windows.modules. windows.modules enumerates loaded kernel modules by traversing PsLoadedModuleList, yielding names, base addresses, and sizes suitable for baseline comparison. The other plugins target different artifacts: driverscan finds driver objects via pool scanning, svcscan lists services, and psscan recovers process objects. Only windows.modules directly satisfies the stated requirement on a Windows memory image.

Answer

windows.driverscan

Answer

windows.psscan

Answer

windows.svcscan

Question 10

A forensic analyst is examining a memory dump from a Windows Server 2016 system that is suspected of being compromised by a kernel-mode rootkit. The analyst wants to identify hidden processes that are not visible through standard process enumeration. Which two Volatility 3 plugins should the analyst use to detect hidden processes by comparing different process listing methods? (Choose two.)

Accepted Answer

windows.psscan. To detect hidden processes, analysts compare the output of windows.pslist, which walks the active process list, with windows.psscan, which scans physical memory for process objects using pool tag scanning. Discrepancies where psscan finds processes not in pslist indicate hidden processes, often due to rootkit activity. The other plugins do not provide this comparison and are used for different forensic purposes.

Answer

windows.handles

Answer

windows.netscan

Answer

windows.dlllist

Question 11

A forensic analyst is examining a memory image from a Windows 10 system suspected of having a rootkit that hides processes by unlinking them from the active process list. The analyst runs windows.pslist and windows.psscan to compare results. Which two of the following statements accurately describe the expected findings or implications? (Choose two.)

Accepted Answer

Processes present in windows.psscan but absent in windows.pslist are likely hidden by rootkit activity.. The correct statements highlight that windows.psscan can reveal processes hidden from the active list and may also report terminated processes whose structures remain. These behaviors are essential for detecting rootkits that unlink processes. The other statements contain factual errors about the tools' methods or draw unsupported conclusions from identical output.

Answer

Processes present in windows.pslist but absent in windows.psscan indicate that the process terminated normally and its memory was freed.

Answer

If windows.psscan and windows.pslist produce identical output, it definitively proves that no rootkit is present on the system.

Answer

windows.pslist relies on pool tag scanning, while windows.psscan walks the active process list.

Question 12

An examiner is reviewing a Windows memory image for evidence of process hollowing. Which two artifacts, when observed together, most strongly support that a process has been hollowed? (Choose two.)

Accepted Answer

The process's primary image memory region is not backed by the file on disk that its path indicates.. Process hollowing unmaps or overwrites the original image and injects replacement code, so the primary image region loses its legitimate file backing and threads often start in unbacked memory. Observing both an unbacked primary image and a thread starting outside known modules forms a coherent, high-confidence pattern. Pipe handles, token privilege changes, and working set size are unrelated to the hollowing technique.

Answer

The process's token has been modified to include SeDebugPrivilege.

Answer

The process has a working set larger than the system average.

Answer

The process has a large number of handles open to named pipes.

Question 13

A security analyst is investigating a potentially compromised Windows 7 workstation. The analyst has acquired a memory image and wants to quickly identify any processes that have been terminated but might still have residual information in memory. Which Volatility 3 plugin should the analyst use to list processes that are no longer active but may still be present in the memory dump?

Accepted Answer

windows.psscan. The windows.psscan plugin scans physical memory for process objects, which allows it to find processes that have been terminated but whose structures have not been overwritten. This is useful for identifying residual evidence from terminated processes. In contrast, pslist and pstree only show active processes, and cmdline provides arguments for active processes. Therefore, psscan is the correct choice for finding terminated processes in a memory dump.

Answer

windows.cmdline

Answer

windows.pslist

Answer

windows.pstree

Question 14

During a memory forensics examination of a Windows 10 system, an analyst observes that a process named 'svchost.exe' has a parent process ID (PPID) that does not correspond to any known system process. The analyst suspects process spoofing. Which Volatility 3 plugin should the analyst use to examine the process's parent-child relationship and verify the legitimacy of the parent process?

Accepted Answer

windows.pstree. The windows.pstree plugin is designed to display processes in a tree structure, showing parent-child relationships. This makes it easy to spot a svchost.exe with an unusual parent, such as a non-system process, which is a common sign of process spoofing. Other plugins like pslist, cmdline, and dlllist do not provide this hierarchical view, making pstree the correct choice for verifying process legitimacy.

Answer

windows.dlllist

Answer

windows.cmdline

Answer

windows.pslist

Question 15

A responder has captured a memory image from a running Windows server and needs to preserve it for later analysis. Which action best maintains the forensic integrity of the acquired memory image?

Accepted Answer

Compute a cryptographic hash of the memory image immediately after acquisition and record it in the case notes.. Cryptographic hashing immediately after acquisition establishes a verifiable integrity baseline for the memory image. Storing the image on the source host, using proprietary compression before hashing, or inspecting it in a hex editor does not provide that assurance and may introduce risk. Hashing is the standard, defensible method to demonstrate the image has not been altered.

Answer

Compress the memory image with a proprietary format to reduce its size before hashing.

Answer

Open the memory image in a hex editor to verify its contents before storing it.

Answer

Store the memory image on the same server from which it was captured to preserve chain of custody.