Digital Forensics and Incident Response - Second Edition

Questions

1. What are some of the data points that can be found via memory analysis?

A) Running processes B) Network connection C) Command historyD) All of the above

2. What is not part of the network connections methodology?

A) Process name B) Parent process ID C) Check for signs of a rootkitD) Associated entities

3. Dumping files associated with a process will never introduce malware to a responder's system.

A) True B) False

4. One of the primary goals of memory analysis is to acquire malicious processes or executables for further analysis.

A) TrueB) False