300-215 · Question #79
Data has been exfiltrated and advertised for sale on the dark web. Incident Response has narrowed down which server has been accessed by the threat actor based on the event logs. On the call with IT…
The correct answer is D. Check the Memory.dmp file in the Windows directory for memory leak indications. The symptoms - growing page file usage, CPU spikes correlating with disk I/O, and high page- fault rates - point to a memory leak or runaway process exhausting RAM. Examining the Windows memory dump (Memory.dmp) lets you see which processes or drivers are consuming excessive…
Question
Data has been exfiltrated and advertised for sale on the dark web. Incident Response has narrowed down which server has been accessed by the threat actor based on the event logs. On the call with IT team, one of the engineers mentions these observations around this particular web server:
- The database running on the server has become unresponsive.
- The PageFile.sys size is consistently changing.
- The server’s disk usage peaks during CPU spikes.
- The Performance Monitor indicates high page faults during these
spikes. Which action should the IR team perform on the server?
Options
- AReview the database.log file in the program files directory for database errors
- BExamine the system.cfg file in the Windows directory for improper system configurations
- CAnalyze the PageFile.sys file in the System Drive and the Virtual Memory configuration
- DCheck the Memory.dmp file in the Windows directory for memory leak indications
How the community answered
(33 responses)- A3% (1)
- B9% (3)
- C21% (7)
- D67% (22)
Explanation
The symptoms - growing page file usage, CPU spikes correlating with disk I/O, and high page- fault rates - point to a memory leak or runaway process exhausting RAM. Examining the Windows memory dump (Memory.dmp) lets you see which processes or drivers are consuming excessive memory, identifying the leak’s root cause.
Topics
Community Discussion
No community discussion yet for this question.