SANS FOR508 CERTIFICATION SCRIPT 2026 QUESTIONS
WITH SOLUTIONS GRADED A+
● Steps of the Incident Response Process. Answer: Preparation Identification and Scoping
Containment/Intel Development Eradication/Remediation Recovery Follow up
● When using the Volatility imageinfo plugin, what information can be used to reduce
the time the tool uses to generate additional data?. Answer: The location of the Kernel
Debugger DataBlock (KDBG)
● hollowfind. Answer: Compares information stored in the PEB with information in the VAD
that should match as well as looking for unusual memory section permissions in an effort to
detect Process Hollowing
● Process Hollowing. Answer: Technique used by malware to load and pause a legitimate
executable then replace a portion of the legitimate code with malware
● pstotal. Answer: Volatility plugin that produces a graphical view of processes in memory
● directory handles. Answer: Known lists within the kernel that allow a process to find kernel
objects - not associated with file system directories
● DLL. Answer: Defines the capabilities of a Windows process
● Socket. Answer: A process object that defines network connection endpoints. Every
network socket is assigned to a specific process allowing network activities to be traced to a
process
● psscan. Answer: Volatility plugin that scans memory to identify terminated processes within
unallocated memory and processes hiding due to rootkit techniques
● What will cause the C time of a file to be updated. Answer: Change in file size Change in
security permission Change in file ownership
● mmls. Answer: determines which OS and physical layout is used by a disk or disk image
● fls. Answer: file system timeline creation tool that can create timelines for ISO 9660 file
systems(CDROM)
WITH SOLUTIONS GRADED A+
● Steps of the Incident Response Process. Answer: Preparation Identification and Scoping
Containment/Intel Development Eradication/Remediation Recovery Follow up
● When using the Volatility imageinfo plugin, what information can be used to reduce
the time the tool uses to generate additional data?. Answer: The location of the Kernel
Debugger DataBlock (KDBG)
● hollowfind. Answer: Compares information stored in the PEB with information in the VAD
that should match as well as looking for unusual memory section permissions in an effort to
detect Process Hollowing
● Process Hollowing. Answer: Technique used by malware to load and pause a legitimate
executable then replace a portion of the legitimate code with malware
● pstotal. Answer: Volatility plugin that produces a graphical view of processes in memory
● directory handles. Answer: Known lists within the kernel that allow a process to find kernel
objects - not associated with file system directories
● DLL. Answer: Defines the capabilities of a Windows process
● Socket. Answer: A process object that defines network connection endpoints. Every
network socket is assigned to a specific process allowing network activities to be traced to a
process
● psscan. Answer: Volatility plugin that scans memory to identify terminated processes within
unallocated memory and processes hiding due to rootkit techniques
● What will cause the C time of a file to be updated. Answer: Change in file size Change in
security permission Change in file ownership
● mmls. Answer: determines which OS and physical layout is used by a disk or disk image
● fls. Answer: file system timeline creation tool that can create timelines for ISO 9660 file
systems(CDROM)
