hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: During a forensic investigation, an analyst finds…
During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform memory analysis using volatility on an isolated forensic workstation.
Memory forensics on a different system enables analysis of the memory dump without relying on the compromised OS, allowing detection of kernel-mode rootkits that hide from OS-level tools. Option A (antivirus on disk image) depends on the compromised OS and may miss rootkits that hide from file system scans. Option B (registry snapshots) is ineffective because kernel rootkits operate below the registry level and can manipulate or avoid registry entries. Option C (network packet captures) may show C2 traffic but does not directly detect the rootkit itself, and many rootkits use encrypted communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run antivirus scans on the disk image.
Why it's wrong here
Antivirus may not detect advanced rootkits and the OS could be compromised.
- ✗
Compare registry snapshots before and after infection.
Why it's wrong here
Rootkits can hide registry keys, and the registry may be compromised.
- ✗
Analyze network packet captures for C2 traffic.
Why it's wrong here
Network analysis may not directly reveal kernel-mode rootkits.
- ✓
Perform memory analysis using volatility on an isolated forensic workstation.
Why this is correct
Memory analysis from a dump allows detection of kernel-mode artifacts without trusting the compromised OS.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.