CHFI Incident Response and First Responder Skills Practice Question
An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?
⚠ Common exam trap
EC-Council often tests the principle that volatile data (memory) must be captured before any containment or analysis steps, and the trap here is that candidates mistakenly prioritize network containment (option B) over evidence preservation, forgetting that disconnecting the network can destroy critical volatile artifacts like active connections and encryption keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.
Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.
Why this is correct
Capturing a full memory dump with FTK Imager (Memory Capture) or DumpIt preserves the entire contents of RAM, including running processes, loaded drivers, active network sockets, decrypted data, and injected code that exist only in volatile memory at that instant. This adheres to the order of volatility and allows analysis of the live system state without altering or destroying it. Memory imaging is the highest-priority step because many advanced threats operate solely in memory and leave minimal traces on disk.
- ✗
Immediately disconnect the system from the network to contain the threat.
Why it's wrong here
Immediately disconnecting the system from the network before imaging changes its volatile state: active TCP/UDP connections, open ports, cached credentials, and recent DNS queries may be terminated or altered, destroying transient evidence of command-and-control communication. Malware can also react to network loss by deleting in-memory artifacts or switching to alternate persistence mechanisms. Proper containment should occur after memory has been captured, or through methods that preserve connection metadata such as span ports or firewall rules.
- ✗
Check the Windows Event Logs for related entries.
Why it's wrong here
Windows Event Logs are stored on disk and can be acquired later without the same urgency as RAM, so checking them first delays the critical preservation of volatile data. Viewing logs also does not reveal the current in-memory state, such as a process's parent PID, loaded API hooks, or injected payload, and it may miss activity that has not yet been logged. Launching Event Viewer can itself generate additional events and alter the system, whereas memory capture should be the initial, least-invasive step.
- ✗
Reboot the system to clear any malicious processes from memory.
Why it's wrong here
Rebooting the system is the antithesis of volatile data preservation, as it flushes RAM and destroys the very artifacts—malicious processes, active network connections, and encryption keys—that triggered the alert. Some malware families detect a shutdown event and trigger destructive routines or hide persistent boot components, further complicating the investigation. A forensic responder must avoid any action that degrades volatile evidence, including power cycling, until a complete memory image has been secured.
Go deeper
Related to this question
Learn chapter
Overview of Computer Forensics and Investigation Process
Key term
FTK Imager
FTK Imager is a free forensic imaging tool used to create exact copies of computer drives and storage devices for digital evidence analysis.
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.