Jump to content



Photo

Q on Security+ Q and A

security+

  • Please log in to reply
5 replies to this topic

#1 netsurfer802

netsurfer802

    Neowinian

  • Joined: 27-September 10

Posted 26 December 2012 - 00:05

I'm studying for the Security+ exam and in my study material noticed that one of the questions and answers I have says:


In which of the following locations would a forensic analyst look to find a hooked process?
A. BIOS
B. Slack space
C. RAM
D. Rootkit

Answer: A

Yet when I tried to look information about a hooked process I came up with the follow--see link below--so which is right?


http://wiki.answers...._hooked_process


#2 primexx

primexx

    Neowinian Senior

  • Tech Issues Solved: 6
  • Joined: 24-April 05

Posted 26 December 2012 - 10:54

RAM. none of the other choices even potentially make sense.

#3 Nick H.

Nick H.

    Neowinian Senior

  • Tech Issues Solved: 14
  • Joined: 28-June 04
  • Location: Switzerland

Posted 26 December 2012 - 11:19

In which of the following locations would a forensic analyst look to find a hooked process?
A. BIOS
B. Slack space
C. RAM
D. Rootkit

Answer: A

Wait, is that answer from the book, or is that your assumption?

RAM is definitely the answer. If the book is telling you differently, you might want to contact your professor (if you have one) to get him to let others know that there is an error.

#4 +ChuckFinley

ChuckFinley

    member_id=28229

  • Joined: 14-May 03

Posted 26 December 2012 - 13:11

Yeah I dont even know why they put "Slack Space" in there. You could have rootkit because the Rootkit might be the one doing the hooking perhaps.

#5 primexx

primexx

    Neowinian Senior

  • Tech Issues Solved: 6
  • Joined: 24-April 05

Posted 27 December 2012 - 09:41

Yeah I dont even know why they put "Slack Space" in there. You could have rootkit because the Rootkit might be the one doing the hooking perhaps.

a rootkit is a thing, not a location

#6 +Nik L

Nik L

    Where's my pants?

  • Tech Issues Solved: 2
  • Joined: 14-January 03

Posted 27 December 2012 - 09:47

Ram is the only answer that makes any kind of sense!