Multiple Choice
Volatile Memory is one of the leading problems for forensics. Worms such as code Red are memory resident and do write themselves to the hard drive, if you turn the system off they disappear. In a lab environment, which of the following options would you suggest as the most appropriate to overcome the problem of capturing volatile memory?
A) Use VMware to be able to capture the data in memory and examine it
B) Give the Operating System a minimal amount of memory, forcing it to use a swap file
C) Create a Separate partition of several hundred megabytes and place the swap file there
D) Use intrusion forensic techniques to study memory resident infections
Correct Answer:
Verified
Correct Answer:
Verified
Q358: When investigating a Windows System, it is
Q359: Dataflow diagrams are used by IT auditors
Q360: When analyzing and forecasting an operating expense
Q361: You manage a newly created Security Operations
Q362: Which of the following is a weakness
Q364: Which of the following represents the MOST
Q365: You should make at least how many
Q366: Which of the following is the MOST
Q367: Meyer Electronics Systems just recently had a
Q368: What operating system would respond to the