GCFA Practice Question: Analyzing Volatile and Windows Event Artifacts
During a live response on a Windows 10 workstation suspected of lateral movement, you capture volatile memory and also export the Windows Event Logs. You need to correlate a process that was running at the time of capture with its parent process and the user account that launched it, using only the memory image. Which Volatility 3 plugin should you run to produce a parent-child process tree with PID/PPID, image name, and offset columns?
⚠ Common exam trap
The trap here is assuming any process-listing plugin shows lineage; pslist shows PPID as a column but does not construct the parent-child tree that pstree does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
windows.pstree
The goal is a parent-child process tree with PID, PPID, and image name from a memory image. The pstree plugin is purpose-built for that: it traverses the active process list and renders indentation that shows lineage. Other plugins either list processes flatly, hunt for hidden or terminated objects, or resolve SIDs, none of which produce the tree structure required here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
windows.getsids
Why it's wrong here
windows.getsids walks each process and prints the SID of the user that created it, which helps attribute a process to an account. However, it does not output a process tree or parent-child relationships, so it cannot by itself correlate the process lineage the analyst needs without additional plugins.
- ✓
windows.pstree
Why this is correct
windows.pstree walks the ActiveProcessLinks list and prints each process with its PID, PPID, image name, and offset, rendering an indented tree. This directly exposes parent-child relationships at capture time, letting you tie a suspicious child to the process that spawned it and, by cross-referencing windows.getsids or windows.cmdline, to the launching user context.
- ✗
windows.pslist
Why it's wrong here
windows.pslist enumerates processes by following the ActiveProcessLinks list and prints PID, PPID, image name, and creation time in a flat table. It does show PPID as a column, but it does not build a visual tree or resolve the parent relationship, so it is less efficient than a dedicated tree plugin when the analyst must quickly trace lineage.
- ✗
windows.psscan
Why it's wrong here
windows.psscan scans for pool tags to find terminated or hidden process objects that are no longer in the active list. It is designed for uncovering unlinked processes, not for producing a clean parent-child tree of currently running processes, so it would add noise and lack reliable PPID linkage for the correlation task.
Visual reference
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.