Questions

Answer the following questions to test your knowledge of this chapter:

1. What are some of the data points that can be found via memory analysis?
   1. Running processes
   2. Network connection
   3. Command history
   4. All of the above
2. What is not part of the network connections methodology?
   1. Process name
   2. Parent process ID
   3. Check for signs of a rootkit
   4. Associated entities
3. Dumping files associated with a process will never introduce malware into a responder’s system.
   1. True
   2. False
4. One of the primary goals of memory analysis is to acquire malicious processes or executables for further analysis.
   1. True
   2. False