Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Eccouncil 212-89 Exam - Topic 3 Question 55 Discussion

John is performing memory dump analysis in order to find out the traces of malware.He has employed volatility tool in order to achieve his objective.Which of the following volatility framework commands he will use in order to analyze running process from the memory dump?
B) python vol.py pslist --profile=Win2008SP1x86 --f /root/Desktop/memdump.mem
A) python vol.py svcscan --profile=Win2008SP1x86 --f /root/Desktop/memdump.mem | more
C) python vol.py hivelist --profile=Win2008SP1x86 --f /root/Desktop/memdump.mem
D) python vol.py imageinfo -f /root/Desktop/memdump.mem

Eccouncil 212-89 Exam - Topic 3 Question 55 Discussion

Actual exam question for Eccouncil's 212-89 exam
Question #: 55
Topic #: 3
[All 212-89 Questions]

John is performing memory dump analysis in order to find out the traces of malware.

He has employed volatility tool in order to achieve his objective.

Which of the following volatility framework commands he will use in order to analyze running process from the memory dump?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Lina at Apr 29, 2024, 09:17 PM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Stevie
8 months ago
Surprised that people aren't mentioning the importance of profiles in these commands!
upvoted 0 times
...
Denae
8 months ago
Wait, is B really the best choice? I thought D might be useful too.
upvoted 0 times
...
Lea
8 months ago
C is for registry hives, not processes.
upvoted 0 times
...
Tracie
8 months ago
I think A could work too, but not for processes specifically.
upvoted 0 times
...
Aliza
8 months ago
Definitely B, that's the command for listing processes!
upvoted 0 times
...
Cyril
9 months ago
I feel like `hivelist` is related to registry hives, not processes. I guess it’s between A and B, but I’m leaning towards B.
upvoted 0 times
...
Zona
9 months ago
I practiced with `imageinfo` before, but that’s for getting info about the image, not processes. So I think it’s not D.
upvoted 0 times
...
Tresa
9 months ago
I'm not entirely sure, but I think `svcscan` is more about services than processes. Maybe it's A or B?
upvoted 0 times
...
Jaime
9 months ago
I remember that the `pslist` command is used to list running processes, so I think option B might be the right choice.
upvoted 0 times
...
Candida
9 months ago
I'm a bit confused by this question. I know Volatility is a powerful tool, but I'm not sure which specific command would be best for this task. Maybe the svcscan command would be a good option to look at the running services? I'll have to think about this one a bit more.
upvoted 0 times
...
Micaela
9 months ago
Ah, this is a good one! I've used the Volatility framework before for memory analysis, and I'd say the pslist command is definitely the way to go here. It'll give you a nice overview of the running processes, which is exactly what John needs to find any malware traces.
upvoted 0 times
...
Eladia
9 months ago
I think the answer is B. The pslist command in the Volatility framework is used to list the running processes in the memory dump, which should help John identify any traces of malware.
upvoted 0 times
...
Leila
9 months ago
Hmm, I'm a bit unsure about this one. I know the Volatility framework has a lot of different commands, and I'm not entirely familiar with all of them. I'll have to double-check the documentation to make sure I'm choosing the right one.
upvoted 0 times
...
Levi
9 months ago
Okay, I've got this. The key here is understanding that an Internet gateway is defined at the VPC level, not the Region level. So the correct answer has to be either A or C.
upvoted 0 times
...
Leonor
10 months ago
Hmm, I'm a bit unsure about this one. The options seem to be focused on SNMP and engine-ID, so I'll need to make sure I understand those concepts well before attempting to answer.
upvoted 0 times
...
Kara
10 months ago
Hmm, I'm a little unsure about this one. I know allopurinol inhibits xanthine oxidase, but I can't quite remember how that affects 6-mercaptopurine. I'll have to think this through carefully.
upvoted 0 times
...
Quentin
2 years ago
So, option B fits best for analyzing running processes.
upvoted 0 times
...
Charolette
2 years ago
Yes, and imageinfo provides memory image information.
upvoted 0 times
...
Salome
2 years ago
Yeah, hivelist is for registry, right?
upvoted 0 times
...
Peter
2 years ago
I think the answer is B. pslist is for running processes.
upvoted 0 times
...
Quentin
2 years ago
Agreed, you need to know Volatility commands well.
upvoted 0 times
...
Salome
2 years ago
This exam question looks tricky.
upvoted 0 times
...

Save Cancel