GCFA Introduction to Memory Forensics Practice Question
A forensic analyst captures a memory image from a Windows 10 workstation using a hardware acquisition tool. The analyst then wants to enumerate the loaded kernel modules to compare against a known-good baseline. Which Volatility 3 plugin should the analyst run to list the loaded kernel modules from the memory image?
⚠ Common exam trap
Many candidates confuse process-level DLL enumeration with kernel module enumeration, as both involve loaded code but operate at different privilege levels and require different plugins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
windows.modules
The windows.modules plugin is designed to enumerate loaded kernel modules from a Windows memory image, providing a list of drivers and their base addresses. This is essential for comparing against a known-good baseline to identify unauthorized or malicious kernel modules. The other plugins target process lists, DLLs within processes, or handles, none of which directly provide a system-wide kernel module enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
windows.dlllist
Why it's wrong here
windows.dlllist lists DLLs loaded into a specific process, not kernel modules. It requires a process context and focuses on user-mode libraries. While useful for analyzing process dependencies, it does not enumerate kernel drivers loaded system-wide. Thus, it would not provide the kernel module list needed for baseline comparison in this scenario.
- ✓
windows.modules
Why this is correct
windows.modules scans the kernel module list and reports loaded kernel modules, including drivers and their base addresses. This directly supports comparing loaded modules against a known-good baseline to detect unauthorized drivers. It is the appropriate Volatility 3 plugin for enumerating kernel modules from a Windows memory image, making it the correct choice here.
- ✗
windows.handles
Why it's wrong here
windows.handles enumerates open handles for processes, such as file, registry, and event handles. It does not list loaded kernel modules. Although handle analysis can reveal suspicious resource usage, it is unrelated to the task of enumerating kernel drivers. Therefore, it is not the correct plugin for this requirement.
- ✗
windows.pslist
Why it's wrong here
windows.pslist enumerates active processes by walking the doubly linked list of EPROCESS structures. It does not list kernel modules such as drivers or DLLs. While process enumeration is a common early step in memory analysis, it does not fulfill the requirement of listing loaded kernel modules for baseline comparison. Therefore, it is not the correct plugin for this scenario.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.