CS0-003 Security Operations Practice Question
During a memory analysis of a potentially compromised host, a security analyst finds a process with an executable image that is not present on disk. Which technique is most likely being observed?
⚠ Common exam trap
The trap is confusing process hollowing with reflective DLL injection — both involve in-memory code, but only hollowing produces a running process whose primary executable image is absent from disk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Process hollowing
Process hollowing (a form of process replacement) involves creating a legitimate process in a suspended state, unmapping its original executable image from memory, and writing malicious code into that address space before resuming it. The result is a running process whose in-memory image does not correspond to any executable on disk — exactly the artifact described. This is a classic malware evasion technique used by families such as TrickBot and Emotet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reflective DLL injection
Why it's wrong here
Reflective DLL injection bypasses traditional OS loader APIs by mapping a library directly from memory into a host process using a custom loader. While this technique avoids writing the DLL to disk, the host process's primary executable image remains intact and unchanged. This distinguishes it from process hollowing, where the entire primary executable image is unmapped and replaced.
- ✓
Process hollowing
Why this is correct
Process hollowing involves spawning a legitimate process in a suspended state, unmapping its original executable image from memory, and replacing it with a malicious payload. Because the process's metadata and path point to a legitimate disk-backed executable while the memory contains unauthorized code, it creates a memory-only execution state that evades standard signature-based detection.
- ✗
API hooking
Why it's wrong here
API hooking is a technique used to intercept and redirect function calls or Windows API requests to monitor or alter behavior. While it modifies the execution flow of a process by altering function pointers or inserting jump instructions, it does not replace the primary process image or unmap the executable from memory.
- ✗
DLL injection
Why it's wrong here
Standard DLL injection forces a running target process to load a malicious dynamic link library from disk, typically using APIs like VirtualAllocEx and CreateRemoteThread. The host process's original executable remains fully intact and active, meaning the malicious payload runs alongside legitimate code rather than completely replacing the process's memory space.
Go deeper
Related to this question
Learn chapter
Malware Analysis: Static vs Dynamic
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.