300-215 Question 52
Single answerDuring an incident response, a security analyst suspects that malicious activity is still active in the memory of an infected endpoint. The analyst decides to use a memory forensics tool to capture and analyze the memory. Which of the following tools would be most suitable for capturing and analyzing the memory dump?
- A
Volatility
- B
Wireshark
- C
FTK Imager
- D
Cisco Threat Response
Show answer and explanation
Correct answer: A
Explanation
Volatility is specifically designed for memory forensics, making it the most suitable tool for capturing and analyzing a memory dump during an incident response. While other tools like FTK Imager can capture memory, they lack the comprehensive analysis capabilities of Volatility.
- A. Correct.
Volatility is a widely used memory forensics framework, suitable for analyzing volatile memory and identifying artifacts such as processes, network connections, and injected code.
- B. Incorrect.
Wireshark is a network protocol analyzer, not a tool designed for memory forensics or analyzing memory dumps.
- C. Incorrect.
FTK Imager is primarily used for disk imaging and basic analysis. While it can capture memory, it is not as robust as Volatility for memory analysis.
- D. Incorrect.
Cisco Threat Response is a threat intelligence tool that integrates with other Cisco security solutions but is not used for memory forensics.