GCFA Introduction to Memory Forensics Practice Test 4 — 15 Questions

Question 1

You have acquired a memory image from a Windows Server 2019 system using WinPmem. You need to determine the operating system version and service pack level to ensure you use the correct Volatility profile or symbol table. Which Volatility 3 plugin provides this information directly from the memory image?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

windows.info. To identify the operating system version and service pack from a memory image, you need a plugin that reads kernel version data. windows.info extracts this directly from the kernel structures in memory, providing the build number and service pack level. The other plugins focus on registry hives, process listing, and command lines, none of which directly report the OS version in a concise manner.

Answer

windows.cmdline

Answer

windows.registry.hivelist

Answer

windows.pslist

Question 2

During memory analysis of a Windows host, an examiner runs windows.netscan and observes several established TCP connections originating from a process that no longer appears in the process list. Which conclusion is most appropriate?

Accepted Answer

The connections are likely residual artifacts from a terminated process, and the examiner should correlate timestamps and process IDs to confirm.. windows.netscan can surface network structures that outlive their owning process, so missing process entries alongside established connections often reflect terminated processes rather than hidden malware. Correlating process IDs, timestamps, and other artifacts is the proper next step. Claiming rootkit activity, image corruption, or a confirmed attack from this observation alone is premature and unsupported.

Answer

The connections are proof of a network-based attack and should be reported as a confirmed incident.

Answer

The connections indicate that the memory image is corrupted and should be reacquired.

Answer

The connections prove that a rootkit is hiding a running process from the process list.

Question 3

A forensic analyst is examining a memory dump from a Windows Server 2016 system that is suspected of being compromised by a kernel-mode rootkit. The analyst runs Volatility 3 and observes several anomalies. Which two of the following artifacts are most indicative of a kernel-mode rootkit that uses SSDT hooking? (Choose two.)

Accepted Answer

The SSDT is found to be writable in memory, whereas it should be read-only in a clean system.. SSDT hooking involves redirecting system service calls by modifying the SSDT, which normally points to functions within ntoskrnl.exe. Two key indicators are SSDT entries pointing outside ntoskrnl.exe and the SSDT being writable when it should be read-only. Other artifacts like missing driver files or IDT variations are not specific to SSDT hooking, and a modified kernel hash indicates patching rather than hooking.

Answer

The presence of a driver object with no corresponding file on disk in the drivers directory.

Answer

The ntoskrnl.exe module in memory has a different hash than the known-good version from the same Windows build.

Answer

The KPCR (Kernel Processor Control Region) for each CPU shows a different value for the IDT base address.

Question 4

During a live response on a Windows 10 workstation suspected of malware infection, an examiner captures a full physical memory image using WinPmem. The examiner later wants to determine whether the captured image contains enough context to reconstruct which user account was interactively logged on at the time of acquisition. Which memory structure would the examiner primarily parse to identify the active interactive session and its associated user?

Accepted Answer

The token object referenced by explorer.exe, because its user SID identifies the interactively logged-on account.. The interactive user's identity is tied to the token of a process running in that user's session, such as explorer.exe. Extracting the token SID from explorer.exe's EPROCESS in the memory image confirms which account was interactively logged on. Other structures like KDBG or winlogon's EPROCESS do not directly hold the interactive user SID, making them unsuitable for this specific attribution.

Answer

The KDBG structure, because it stores the list of logged-on user sessions and their SIDs.

Answer

The EPROCESS block for winlogon.exe, because it stores the Security Identifier (SID) of the interactive user.

Answer

The PEB of lsass.exe, because it caches the credentials of the interactive user in plaintext.

Question 5

You are analyzing a Windows 10 memory dump for evidence of a kernel-mode rootkit that may have unlinked a malicious driver from the active module list. Which two Volatility 3 plugins would you use together to detect and enumerate such a hidden driver? (Choose two.)

Accepted Answer

windows.modscan. To detect a driver that has been unlinked from the active module list, you need plugins that scan kernel pool memory for driver-related structures. windows.modscan finds module structures, and windows.driverscan finds driver objects. Together they can reveal a hidden driver that a rootkit has unlinked. The other plugins either list only active modules, focus on IRP hooking, or enumerate callbacks, none of which directly detect unlinked drivers.

Answer

windows.driverirp

Answer

windows.callbacks

Answer

windows.modules

Question 6

You are examining a Windows 10 memory image and notice a process with a handle to a file named 'svchost.exe' located in a user's temp directory. You want to determine the full path and access type of this handle. Which Volatility 3 plugin should you use?

Accepted Answer

windows.handles. To find the full path and access type of a file handle, you need a plugin that enumerates handles per process. windows.handles provides exactly that, showing the object name (full path) and granted access for each handle. The other plugins focus on scanning file objects without process association, listing loaded DLLs, or displaying privileges, none of which directly answer the question about a specific handle.

Answer

windows.filescan

Answer

windows.privs

Answer

windows.dlllist

Question 7

A forensic analyst is examining a Windows Server 2016 memory image for evidence of a kernel-mode rootkit. The analyst runs the Volatility 3 windows.psscan plugin and observes a process named 'svchost.exe' with PID 1337 that does not appear in the windows.pslist output. Further inspection shows that the process has no corresponding entry in the active process list but has a valid EPROCESS structure in pool memory. What is the most likely explanation for this discrepancy?

Accepted Answer

The process is hidden from the active process list due to direct kernel object manipulation (DKOM) unlinking its EPROCESS from the PsActiveProcessHead list.. The discrepancy between psscan and pslist where a process appears in pool scanning but not in the active list is a hallmark of DKOM-based process hiding. Rootkits unlink the EPROCESS from the active process list to evade detection by tools that walk that list. Pool scanning finds the structure directly in memory, revealing the hidden process. This is a fundamental technique in memory forensics for detecting stealthy malware.

Answer

The process is a legitimate service host that was terminated and its EPROCESS is lingering in pool memory before being freed.

Answer

The process is a child of a protected process and is intentionally excluded from the active process list by Windows security features.

Answer

The process is a zombie process that has been reaped by its parent but its EPROCESS remains in memory due to a handle leak.

Question 8

An examiner is analyzing a Windows memory image and wants to determine whether a specific kernel driver was loaded and then unloaded during the system's uptime. Which approach is most appropriate?

Accepted Answer

Search for the driver's pool tags and compare them against the current loaded module list to identify remnants of an unloaded driver.. Pool tags and residual pool allocations can persist after a driver unloads, so searching for a driver's known pool tags and comparing against the current module list can reveal that it was loaded earlier. The module list itself only shows current modules, registry keys show configuration, and event logs are not reliable for this purpose in memory forensics.

Answer

Check the system event log for a service control manager entry indicating the driver was started.

Answer

Examine the registry hives in memory for the driver's service key and confirm its start type.

Answer

Run windows.modules and check whether the driver appears in the output.

Question 9

A digital forensics examiner is analyzing a memory dump from a Windows 7 system using Volatility 3. The examiner wants to identify all network connections that were active at the time of the capture, including the process responsible for each connection. Which Volatility 3 plugin should the examiner use to achieve this goal?

Accepted Answer

windows.netscan. The windows.netscan plugin in Volatility 3 is specifically designed to scan memory for network connection structures and correlate them with owning processes. It provides a comprehensive view of active TCP and UDP endpoints, including local and remote addresses, ports, and process IDs. Other plugin names listed are either non-existent or less reliable, making windows.netscan the correct choice for this task.

Answer

windows.sockets

Answer

windows.netstat

Answer

windows.connections

Question 10

An incident responder is analyzing a memory image from a Windows 10 system that is suspected of being infected with a fileless malware. The responder runs the Volatility 3 windows.malfind plugin and observes several memory regions with PAGE_EXECUTE_READWRITE protection and a MZ header. However, the responder notices that some of these regions are backed by a file on disk, while others are not. Which of the following conclusions is most appropriate regarding the unbacked regions?

Accepted Answer

The unbacked regions are indicative of injected code or shellcode, as they do not correspond to any file on disk and have suspicious permissions.. In memory forensics, unbacked memory regions with PAGE_EXECUTE_READWRITE protection and executable content such as an MZ header strongly suggest injected code or shellcode. Legitimate code is typically backed by a file on disk via a mapped section. The lack of file backing means the code was likely written directly into the process's address space by an injection technique, a common characteristic of fileless malware. This finding should prompt further extraction and analysis of the injected payload.

Answer

The unbacked regions are likely legitimate DLLs loaded from disk but with modified permissions due to process hardening.

Answer

The unbacked regions are artifacts of the Volatility plugin itself, which may incorrectly report memory as unbacked due to parsing errors.

Answer

The unbacked regions are likely due to memory compression or paging, where the file backing was temporarily removed from the working set.

Question 11

During a memory forensics investigation, an analyst uses Volatility 3 to examine a Windows 10 memory image. The analyst runs the windows.malfind plugin and observes a memory region with PAGE_EXECUTE_READWRITE protection that contains a PE header and is not backed by a file on disk. The region is associated with a process named explorer.exe. Which of the following conclusions is most appropriate based on this finding?

Accepted Answer

The memory region indicates that explorer.exe has been injected with malicious code, as it exhibits characteristics of process hollowing or reflective DLL injection.. A memory region with PAGE_EXECUTE_READWRITE protection, containing a PE header, and not backed by a file is a strong indicator of code injection. Legitimate processes rarely allocate such memory, and the presence of a PE header suggests a portable executable was loaded directly into memory. This is consistent with techniques like reflective DLL injection or process hollowing, where malicious code is executed within a trusted process to evade detection.

Answer

The memory region is likely a legitimate dynamically allocated buffer used by explorer.exe for temporary data storage.

Answer

The memory region is likely a memory-mapped file that was paged out and later paged back in without file backing due to a system error.

Answer

The memory region is a false positive because windows.malfind often flags legitimate JIT-compiled code from .NET applications.

Question 12

A forensic analyst is examining a memory dump from a Windows 10 system that is suspected of being infected with a rootkit that hides its presence by unlinking its process from the active process list. The analyst runs Volatility 3 and compares the output of the windows.pslist and windows.psscan plugins. Which of the following best describes the expected discrepancy between these two plugins in the presence of such a rootkit?

Accepted Answer

windows.psscan will show more processes than windows.pslist because it can detect processes that have been unlinked from the active process list.. windows.pslist enumerates processes by following the active process list, which a rootkit can manipulate by unlinking its process. windows.psscan, however, scans memory for process objects using pool tags, which does not rely on the list. Therefore, in the presence of a process-unlinking rootkit, windows.psscan will detect the hidden process, resulting in a higher process count compared to windows.pslist. This discrepancy is a key indicator of hidden processes.

Answer

windows.pslist will show more processes than windows.psscan because it includes terminated processes that are still in memory.

Answer

Both plugins will show the same number of processes because they both use the same underlying data structure.

Answer

windows.psscan will show fewer processes than windows.pslist because it relies on a linked list that the rootkit modifies.

Question 13

A forensic analyst is examining a Windows 10 memory image to identify potential process injection. The analyst runs Volatility 3 plugins and focuses on the windows.malfind output. Which two of the following characteristics are most indicative of malicious code injection in a process's memory space? (Choose two.)

Accepted Answer

A memory region with PAGE_EXECUTE_READWRITE protection that contains a MZ header but has no corresponding file path in the VAD.. Indicators of process injection include memory regions with PAGE_EXECUTE_READWRITE protection that are unbacked by a file on disk, especially when they contain executable headers like MZ. These characteristics suggest that code was injected directly into the process's address space, bypassing normal module loading. Legitimate code is usually backed by files and has more restrictive permissions. Therefore, the combination of RWX permissions and lack of file backing is a key red flag.

Answer

A memory region containing a PE header (MZ) that matches a known legitimate system DLL on disk.

Answer

A memory region with PAGE_READONLY protection that contains configuration data.

Answer

A memory region with PAGE_EXECUTE_READ protection that is backed by a signed Microsoft DLL.

Question 14

A forensic examiner is analyzing a memory image from a Windows 7 system that is suspected of being compromised by a sophisticated rootkit. The examiner runs the Volatility 2 plugin 'ssdt' and notices that several system service dispatch table (SSDT) entries point to addresses within a kernel module that is not signed by Microsoft and is not present in the loaded module list. Which of the following best describes the rootkit technique that is most likely in use?

Accepted Answer

SSDT hooking, where the rootkit replaces the function pointers in the SSDT to redirect system calls to its own malicious functions.. The SSDT contains pointers to kernel functions for system services. If entries point to an unsigned module not in the loaded module list, it indicates that the SSDT has been hooked—modified to redirect system calls to malicious code. This is a classic rootkit technique to intercept and manipulate system calls, allowing the rootkit to hide its presence and activities. Inline hooking and IAT hooking affect different structures, and DKOM does not apply to the SSDT in this manner.

Answer

Import Address Table (IAT) hooking, where the rootkit modifies the IAT of user-mode processes to redirect API calls to its own code.

Answer

Inline hooking of the SSDT functions, where the rootkit overwrites the first bytes of the legitimate functions with a jump to its own code.

Answer

DKOM on the SSDT, where the rootkit unlinks the SSDT from the kernel's list of service tables to hide its modifications.

Question 15

An analyst is reviewing a memory image from a Windows server and needs to identify kernel drivers that were loaded but are not present in the list of modules on disk. The analyst runs the Volatility 3 windows.modules plugin and compares the output to a baseline of known-good drivers. Which additional plugin should the analyst run to detect drivers that have been unlinked from the kernel module list but whose code may still be resident in memory?

Accepted Answer

windows.driverscan. A driver unlinked from PsLoadedModuleList will not appear in the modules plugin output, but its DRIVER_OBJECT may still reside in pool memory. The driverscan plugin locates these objects by scanning pool memory, making it the appropriate cross-check for detecting hidden or unlinked kernel drivers in the image.

Answer

windows.callbacks

Answer

windows.svcscan

Answer

windows.ldrmodules