GCFA Introduction to Memory Forensics Practice Question
A forensic analyst is examining a memory dump from a Windows Server 2016 system that is suspected of being compromised by a kernel-mode rootkit. The analyst runs Volatility 3 and observes several anomalies. Which two of the following artifacts are most indicative of a kernel-mode rootkit that uses SSDT hooking? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates confuse general rootkit indicators with specific evidence of SSDT hooking, such as assuming any kernel modification or missing driver file proves SSDT manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSDT is found to be writable in memory, whereas it should be read-only in a clean system.
SSDT hooking involves redirecting system service calls by modifying the SSDT, which normally points to functions within ntoskrnl.exe. Two key indicators are SSDT entries pointing outside ntoskrnl.exe and the SSDT being writable when it should be read-only. Other artifacts like missing driver files or IDT variations are not specific to SSDT hooking, and a modified kernel hash indicates patching rather than hooking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The presence of a driver object with no corresponding file on disk in the drivers directory.
Why it's wrong here
While a driver object without a file on disk can indicate a rootkit, it is not specific to SSDT hooking. Rootkits may use various techniques, and a missing driver file could be due to other reasons like file deletion. SSDT hooking specifically manipulates function pointers, so this artifact alone is less indicative.
- ✓
The SSDT is found to be writable in memory, whereas it should be read-only in a clean system.
Why this is correct
In a clean Windows system, the SSDT is typically protected as read-only after initialization. If the SSDT is writable, it suggests that a rootkit has modified memory protections to allow hooking. This is a strong indicator of SSDT hooking because the rootkit must disable write protection to alter the table.
- ✗
The ntoskrnl.exe module in memory has a different hash than the known-good version from the same Windows build.
Why it's wrong here
A modified ntoskrnl.exe hash could indicate patching, but SSDT hooking does not modify the kernel executable itself; it alters pointers in a data structure. Therefore, a hash mismatch is not a direct indicator of SSDT hooking and could be caused by other modifications or memory corruption.
- ✗
The KPCR (Kernel Processor Control Region) for each CPU shows a different value for the IDT base address.
Why it's wrong here
The KPCR contains per-processor information, but the IDT base address is typically consistent across CPUs in a non-compromised system. Variations could indicate tampering, but SSDT hooking does not directly alter the IDT. This artifact is more relevant to interrupt handling rootkits, not SSDT hooking.
- ✓
The System Service Descriptor Table (SSDT) entries point to addresses outside the ntoskrnl.exe module.
Why this is correct
SSDT hooking involves redirecting system service calls to malicious code. Legitimate SSDT entries should point within ntoskrnl.exe. If entries point to other modules or unbacked memory, it indicates hooking. This is a direct indicator of kernel-mode rootkit activity, as the SSDT is a critical structure for system call dispatching.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.