MENU
John is performing memory dump analysis in order to find out the traces of malware.
He has employed volatility tool in order to achieve his objective.
Which of the following volatility framework commands he will use in order to analyze running process from the memory dump?
Suggested Answer: B
Get Premium 212-89 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
22 comments · newest first
ST
Stevie
11 months ago
Surprised that people aren't mentioning the importance of profiles in these commands!
DE
Denae
11 months ago
Wait, is B really the best choice? I thought D might be useful too.
LE
Lea
11 months ago
C is for registry hives, not processes.
TR
Tracie
12 months ago
I think A could work too, but not for processes specifically.
AL
Aliza
12 months ago
Definitely B, that's the command for listing processes!
CY
Cyril
1 year ago
I feel like `hivelist` is related to registry hives, not processes. I guess it’s between A and B, but I’m leaning towards B.
ZO
Zona
1 year ago
I practiced with `imageinfo` before, but that’s for getting info about the image, not processes. So I think it’s not D.
TR
Tresa
1 year ago
I'm not entirely sure, but I think `svcscan` is more about services than processes. Maybe it's A or B?
JA
Jaime
1 year ago
I remember that the `pslist` command is used to list running processes, so I think option B might be the right choice.
CA
Candida
1 year ago
I'm a bit confused by this question. I know Volatility is a powerful tool, but I'm not sure which specific command would be best for this task. Maybe the svcscan command would be a good option to look at the running services? I'll have to think about this one a bit more.
MI
Micaela
1 year ago
Ah, this is a good one! I've used the Volatility framework before for memory analysis, and I'd say the pslist command is definitely the way to go here. It'll give you a nice overview of the running processes, which is exactly what John needs to find any malware traces.
EL
Eladia
1 year ago
I think the answer is B. The pslist command in the Volatility framework is used to list the running processes in the memory dump, which should help John identify any traces of malware.
LE
Leila
1 year ago
Hmm, I'm a bit unsure about this one. I know the Volatility framework has a lot of different commands, and I'm not entirely familiar with all of them. I'll have to double-check the documentation to make sure I'm choosing the right one.
LE
Levi
1 year ago
Okay, I've got this. The key here is understanding that an Internet gateway is defined at the VPC level, not the Region level. So the correct answer has to be either A or C.
LE
Leonor
1 year ago
Hmm, I'm a bit unsure about this one. The options seem to be focused on SNMP and engine-ID, so I'll need to make sure I understand those concepts well before attempting to answer.
KA
Kara
1 year ago
Hmm, I'm a little unsure about this one. I know allopurinol inhibits xanthine oxidase, but I can't quite remember how that affects 6-mercaptopurine. I'll have to think this through carefully.
QU
Quentin
2 years ago
So, option B fits best for analyzing running processes.
CH
Charolette
2 years ago
Yes, and imageinfo provides memory image information.
SA
Salome
2 years ago
Yeah, hivelist is for registry, right?
PE
Peter
2 years ago
I think the answer is B. pslist is for running processes.
QU
Quentin
2 years ago
Agreed, you need to know Volatility commands well.
SA
Salome
3 years ago
This exam question looks tricky.