A cybersecurity analyst is investigating a case where an unknown service is causing high CPU usage on a Windows server. The analyst must identify the service, investigate its source, and analyze its…

Question

Options

• AVolatility to analyze memory dumps for forensic investigation
• BProcess Explorer from the Sysinternals Suite to monitor and examine active processes
• CTCPdump to capture and analyze network packets
• DSIFT (SANS Investigative Forensic Toolkit) for comprehensive digital forensics

• A
  5% (3)
• B
  76% (45)
• C
  3% (2)
• D
  15% (9)

Explanation

Explanation

Process Explorer from the Sysinternals Suite is the ideal tool here because it provides a real-time, detailed view of active processes, including CPU usage, parent-child process relationships, DLL dependencies, and file paths - making it perfect for identifying a suspicious running service and determining if it's malicious directly on a live system.

Why the distractors are wrong:

• A (Volatility) is a post-mortem memory forensics tool designed for analyzing offline memory dumps, not for investigating live, running processes in real time.
• C (TCPdump) is a network packet capture tool that reveals network traffic, not process behavior or CPU consumption - it wouldn't help identify an unknown service.
• D (SIFT) is a forensic investigation toolkit used for analyzing evidence after an incident, not for live process monitoring on a production server.

Memory Tip: Think of Process Explorer as "Task Manager on steroids" - whenever an exam question involves a live system, running processes, or suspicious services, Process Explorer (Sysinternals) is your go-to. Reserve Volatility and SIFT for post-incident forensics involving offline evidence.

No community discussion yet for this question.