CAS-004 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  pstree

  Why it's wrong here

  pstree renders the process list as a parent-child hierarchy, so it still relies on the same process enumeration that a hidden or unlinked process escapes. It is tempting because tree views help spot suspicious parentage, and would be correct for visualising process relationships, not for recovering processes absent from the listing.

• ✗

  malfind

  Why it's wrong here

  malfind scans for memory regions with executable, non-image characteristics typical of injected code, but it does not enumerate processes hidden from the standard listing. It is tempting because it targets malware artefacts, and would be correct for locating injected code or shellcode within a process rather than unlinked process structures.

• ✓

  psxview

  Why this is correct

  psxview cross-references multiple process-listing sources — such as EPROCESS, PspCidTable and CSRSS handles — and highlights discrepancies where a process appears in some lists but not others. That mismatch exposes processes hidden by rootkits, satisfying the requirement to identify a malicious process absent from the standard listing.

• ✗

  pslist

  Why it's wrong here

  pslist walks the doubly-linked process list that the kernel maintains, so a process unlinked from that list to hide itself stays invisible. It is tempting because pslist is the standard first look at running processes, and it would be the right choice for enumerating normally visible processes during routine triage.