ACE ACE Network & Memory Forensics

Question 1

What critical data does RAM (volatile memory) analysis reveal that traditional disk forensics cannot?

Accepted Answer

Running processes, active network connections, encryption keys, and decrypted data in memory

Answer

Files deleted years before the acquisition

Answer

File system allocation maps and MFT records

Answer

Registry hive files stored on disk

Question 2

According to the order of volatility, which data source must be collected FIRST at a live scene?

Accepted Answer

RAM/memory contents

Answer

External hard drive image

Answer

Log files stored on disk

Answer

Backup tapes in the server room

Question 3

Which FTK Imager feature is used to acquire a live memory dump from a running Windows system?

Accepted Answer

Capture Memory

Answer

Create Disk Image

Answer

Mount Image to Drive Letter

Answer

Add Evidence Item

Question 4

What is a forensic memory dump file used for?

Accepted Answer

Capturing the contents of RAM at a specific point in time for offline forensic analysis

Answer

Permanently erasing sensitive files from a drive

Answer

Creating a verified bit-for-bit copy of a hard disk

Answer

Backing up NTFS MFT records

Question 5

Which Windows registry location stores previously connected wireless (Wi-Fi) network profiles?

Accepted Answer

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles and WLAN event logs

Answer

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Answer

HKLM\SAM\SAM\Domains\Account\Users

Question 6

What does analyzing DNS artifacts during network forensics help an investigator determine?

Accepted Answer

Which domain names a system resolved, revealing connections to websites, C2 servers, or exfiltration targets

Answer

The physical location of a network switch

Answer

The encryption keys used in SSL/TLS sessions

Answer

The hardware MAC addresses of all devices on a subnet