CHFI Malware Forensics Practice Question
An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?
⚠ Common exam trap
The CHFI exam often tests the misconception that live analysis tools (like Task Manager or Process Explorer) are sufficient for detecting memory-resident malware, but they fail to reveal hidden or injected code that only memory forensics can uncover.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Acquire a memory dump and perform memory forensics with tools like Volatility
The malware resides only in memory, making it invisible to disk-based scans. Memory forensics with tools like Volatility allows investigators to analyze RAM artifacts (e.g., processes, network connections, injected code) to detect stealthy malware that never writes to disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a full disk scan with updated antivirus signatures
Why it's wrong here
A full disk scan with updated antivirus signatures is ineffective against stealthy fileless infections because these threats execute directly in memory, often through PowerShell or WMI, and never write a malicious executable to disk. Signature-based AV also depends on known indicators of compromise, so polymorphic or zero-day payloads that are unpacked only in RAM will evade static file scanning, leaving the live infection untouched.
- ✓
Acquire a memory dump and perform memory forensics with tools like Volatility
Why this is correct
Acquiring a memory dump and analyzing it with Volatility is the correct approach because it preserves the volatile state where fileless malware resides, capturing the actual code, injected processes, and hooked kernel structures. Memory forensics allows investigators to enumerate running processes, inspect process memory and VAD trees, and extract indicators that would be lost on reboot, providing the most direct evidence of the infection.
- ✗
Conduct a live analysis using built-in Windows tools like Task Manager
Why it's wrong here
Conducting a live analysis using built-in Windows tools like Task Manager is insufficient because these utilities rely on user-mode APIs that can be subverted by rootkits through API hooking or DKOM, so the malware may simply not appear in process listings. Moreover, the act of clicking through GUI tools writes cache files, updates last-accessed timestamps, and perturbs memory, contaminating the very evidence needed for a reliable forensic examination.
- ✗
Analyze network traffic for anomalies using a NetFlow analyzer
Why it's wrong here
Analyzing network traffic for anomalies with a NetFlow analyzer is a detection technique, not a forensic acquisition, because NetFlow records contain only connection metadata such as IPs, ports, and timestamps, not the executable code or process artifacts needed to prove malware presence. Even if C2 beacons are identified, the actual payload remains in the host's memory, so network analysis must be paired with memory forensics to capture the infection itself.
Go deeper
Related to this question
Learn chapter
Windows Forensics: File Systems and Artifacts
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
RAM Analysis
RAM Analysis is the forensic examination of a computer’s volatile memory to uncover evidence of running processes, network connections, malware, and user activity that is lost when the system is powered off.
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.