ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 227 - SY0-601 discussion

Report
Export

A digital forensics team at a large company is investigating a case in which malicious code was downloaded over an HTTPS connection and was running in memory, but was never committed to disk. Which of the following techniques should the team use to obtain a sample of the malware binary?

A.
pcap reassembly
Answers
A.
pcap reassembly
B.
SSD snapshot
Answers
B.
SSD snapshot
C.
Image volatile memory
Answers
C.
Image volatile memory
D.
Extract from checksums
Answers
D.
Extract from checksums
Suggested answer: C

Explanation:

The best technique for the digital forensics team to use to obtain a sample of the malware binary is to image volatile memory. Volatile memory imaging is a process of collecting a snapshot of the contents of a computer's RAM, which can include active malware programs. According to the CompTIA Security+ SY0-601 Official Text Book, volatile memory imaging can be used to capture active malware programs that are running in memory, but have not yet been committed to disk. This technique is especially useful in cases where the malware is designed to self-destruct or erase itself from the disk after execution.

asked 02/10/2024
Ilias Akarkach
40 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first