GCIH Practice Question: Detecting Exploitation and Covert Communication Tools
An analyst discovers a malicious DLL file in a system directory. What is the most effective way to identify which process loaded this DLL into memory?
⚠ Common exam trap
Candidates often suggest scanning the file system or checking file hashes, which fails to reveal how the malicious DLL was injected or which specific process is currently utilizing it in memory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use memory forensics tools to inspect loaded modules per process.
Identifying the process that loaded a malicious DLL is fundamental for understanding the scope of the compromise. Memory forensic tools can map loaded modules to specific process IDs (PIDs). This is critical because it allows the handler to identify whether the DLL is being used for process injection, persistence, or credential theft, providing the necessary evidence to isolate and remediate the affected processes immediately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Search the file system for other files with similar names.
Why it's wrong here
Searching for similar file names is a basic triage step but does not reveal which process is actively using the malicious DLL. Memory analysis is required to determine the relationship between the file and the running process, which is necessary to understand the active impact of the threat.
- ✗
Examine the Windows Event Logs for file creation events.
Why it's wrong here
Event logs might show when a file was created but will not definitively show which process loaded that DLL into its memory space. To confirm the active use of the DLL, an analyst must look at the process-module mappings in memory, which event logs do not provide.
- ✓
Use memory forensics tools to inspect loaded modules per process.
Why this is correct
Memory forensics tools like Volatility or Rekall can enumerate the loaded DLLs for every running process. This is the only reliable way to confirm which process is actively utilizing the malicious library, allowing the investigator to link the malicious file to the specific process being exploited or controlled.
- ✗
Check the registry for new service installation entries.
Why it's wrong here
While attackers might register a DLL as a service, not all malicious DLLs are loaded through services. They might be injected into legitimate processes like 'explorer.exe' or 'svchost.exe'. Relying solely on service registry keys misses a large category of malicious DLL usage and is not a comprehensive detection strategy.
About these practice questions
One of 322 original GCIH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCIH practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCIH exam.