A digital forensics team at a large company is investigat ng - CompTIA Security+ SY0-701
Question
A digital forensics team at a large company is investigating a case in which malicious code was downloaded over an HTTPS connection and was running in memory, but was never committed to disk. Which of the following techniques should the team use to obtain a sample of the malware binary?
Answers
-
-
-
correct
-
Explanation
Correct Answer: C. Image volatile memory
Since the malicious code is running in memory and was never committed to disk, imaging volatile memory (RAM) is the best technique to capture the malware binary. Memory forensics allows the team to extract active processes, including code executed directly in memory, for analysis. This method ensures that the malware sample can be obtained even if it has no disk presence.
Explanation for Incorrect Options:
pcap reassembly
Packet capture (pcap) reassembly involves analyzing network traffic to reconstruct files or data transmitted over the network. While it might reveal how the malware was downloaded, it won't provide the in-memory binary directly.
SSD snapshot
An SSD snapshot captures the contents of a storage drive, which is not useful in this case since the malware was never written to disk.
Extract from checksums
Checksums are used to verify data integrity and do not provide a means to capture or analyze a malware binary, especially one running in memory.
No Payment Cards Needed
Normally $69
$45/month
Subjects Included
- CompTIA Security+ SY0-701
Additional Features
- Over 300 Practice Questions with Answers
- Quizzes in every Lesson Provided
- Detailed Analysis of Questions with Answers and Explanations
- Detailed Notes with Chapters, Topics & Lessons
- 24/7 Live chat support
- 24/7 WhatsApp support
- One Full Month Access
