300-215 Question 51
Single answerDuring an incident response investigation, you suspect that an attacker has injected malicious code into a running process on a compromised system. Which memory forensics tool would you use to analyze the memory dump and identify such malicious activity?
- A
Volatility
- B
Wireshark
- C
Cisco Threat Response
- D
Splunk
Show answer and explanation
Correct answer: A
Explanation
Memory forensics tools are specialized for analyzing memory dumps to uncover malicious activity such as injected code or hidden processes. Volatility is one of the most widely used tools for this purpose, offering extensive plugins and features to detect anomalies in memory. Other tools like Wireshark, Cisco Threat Response, and Splunk serve different purposes and are not designed for memory forensics.
- A. Correct.
Volatility is a powerful memory forensics framework used to analyze memory dumps and identify malicious processes, injected code, and other artifacts, making it the correct choice for this scenario.
- B. Incorrect.
Wireshark is a packet analysis tool used to inspect network traffic, not memory dumps. It is not suitable for memory forensics.
- C. Incorrect.
Cisco Threat Response is primarily used for threat correlation and incident management across Cisco security products, but it does not provide memory forensics capabilities.
- D. Incorrect.
Splunk is a data analytics platform for log and event correlation but does not specialize in memory forensics.