Which of the following statements describes the Volatility pstree plugin data shown in the image?

The correct answer is C. Cmd.exe was used to launch Powershell.exe. Exam Questions, Study Guides, Practice Tests. Lead the way to help you pass any IT Certification exams, 100% Pass Guaranteed or Full Refund. Especially Cisco, Microsoft, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. Our Slogan: First

Incident Response & Cyber Kill Chain

Question

Exhibit

Options

ANotepad.exe was launched with Administrative privileges
BFirefox.exe was the parent process for Explorer.exe
CCmd.exe was used to launch Powershell.exe
DCmd.exe was the child process of OneDrive.exe

How the community answered

(41 responses)

A
5% (2)
B
7% (3)
C
71% (29)
D
17% (7)

Explanation

Exam Questions, Study Guides, Practice Tests. Lead the way to help you pass any IT Certification exams, 100% Pass Guaranteed or Full Refund. Especially Cisco, Microsoft, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. Our Slogan: First Test, First Pass. Help you to pass any IT Certification exams at the first try. You can reach us at any of the email addresses listed below. Any problems about IT certification or our products, you could rely upon us, we will give you satisfactory answers in 24 hours.

Topics

#Volatility#memory forensics#process tree#pstree plugin

Community Discussion

No community discussion yet for this question.

Full GCIH Practice