CISSP Security Operations Practice Question
A security analyst is selecting forensic tools for an investigation. Which TWO tools are best suited for memory forensics? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Volatility
Volatility is a dedicated memory forensics framework; FTK can also capture and analyze memory, though it's more general. EnCase is disk forensics, Wireshark network, Autopsy disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a widely used network protocol analyzer designed to capture and interactively browse traffic running on a computer network. While invaluable for investigating network-based attacks and analyzing packet captures (PCAPs), it lacks the capability to parse physical memory dumps or extract volatile artifacts from a host's RAM.
- ✓
Volatility
Why this is correct
Volatility is an advanced, open-source framework specifically engineered for volatile memory (RAM) extraction and analysis. It allows forensic analysts to reconstruct active network connections, extract running processes, inspect loaded DLLs, and recover cached credentials directly from a memory dump, making it the premier choice for memory forensics.
- ✗
Autopsy
Why it's wrong here
Autopsy is an open-source, graphical interface for the Sleuth Kit and other digital forensics tools, primarily optimized for hard drive and storage media analysis. It excels at recovering deleted files, indexing metadata, and analyzing file systems, but it is not designed to perform deep, low-level parsing of volatile RAM images.
- ✗
EnCase
Why it's wrong here
EnCase is a proprietary, enterprise-grade digital forensics suite widely used for disk imaging, file recovery, and deep filesystem analysis of non-volatile storage. Although it can acquire memory images, its core analytical engines are tailored for static disk forensics rather than the specialized runtime state reconstruction required for memory analysis.
- ✓
FTK
Why this is correct
Forensic Toolkit (FTK) is a comprehensive digital investigation platform that, unlike traditional disk-only tools, integrates robust memory analysis capabilities directly into its suite. It allows investigators to parse volatile memory dumps to identify active malware, enumerate running processes, and extract volatile artifacts alongside standard disk-based evidence.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.