GCFA Introduction to Memory Forensics Practice Question
In the context of memory forensics, what does the term 'Page File' represent in a crash dump?
⚠ Common exam trap
Candidates often confuse the page file with active physical RAM or volatile registry hives, missing its role as disk-based virtual memory storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A file that stores inactive virtual memory.
The page file is a disk-based extension of physical RAM. When a system performs a dump, it may contain data swapped from physical memory to the page file. Forensic analysts must understand this because critical evidence—such as decrypted payloads or old process data—might exist in the page file rather than the active physical RAM, requiring the analyst to reconstruct the virtual address space using both sources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A reserved section of the CPU cache.
Why it's wrong here
The page file is not related to CPU cache. It is a portion of disk storage used by the memory manager to offload inactive pages from physical RAM. CPU cache is volatile, ultra-fast memory integrated into the processor, which is completely different from the persistent storage mechanism of a page file.
- ✓
A file that stores inactive virtual memory.
Why this is correct
The page file acts as backing store for virtual memory pages that are not currently resident in physical RAM. Forensic analysis often requires examining the page file to recover data that was swapped out, which is common for inactive or long-running processes that hold evidence of malicious activity.
- ✗
A list of all allocated kernel drivers.
Why it's wrong here
The page file does not store driver lists. Driver information is kept in kernel memory structures and the Windows Registry. The page file is strictly a storage area for virtual memory pages, serving as a buffer to extend the available memory capacity beyond the physical limits of the installed RAM.
- ✗
A log of all system process launches.
Why it's wrong here
Process launch logs are typically found in the Windows Event Logs or through persistence mechanism analysis (like Registry keys or Shimcache). The page file is a raw storage dump of memory pages and contains no historical logs of system activity, making it an unsuitable source for chronological event tracing.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.