Memory forensics basics in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the type of memory dump file.

Cybersecurity

file_type = memory_dump.[1]()

Drag options to blanks, or click blank then click option'

Aread

Bopen

Canalyze

Dget_type

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' which reads content but does not identify type.

Using 'open' which opens files but does not return type.

The get_type() method is used to identify the type of a memory dump file in forensic tools.

2fill in blank

medium

Complete the code to extract process information from a memory dump.

Cybersecurity

processes = memory_dump.[1]('process_list')

Drag options to blanks, or click blank then click option'

Aextract

Bget_section

Cload

Dparse

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'load' which loads data but does not specifically extract sections.

Using 'parse' which analyzes but may not extract directly.

The extract() method is used to pull specific data like process lists from a memory dump.

3fill in blank

hard

Fix the error in the code to correctly filter processes by name.

Cybersecurity

filtered = [p for p in processes if p.name [1] 'chrome.exe']

Drag options to blanks, or click blank then click option'

A==

B=

C!=

Dis

Attempts:

3 left

💡 Hint

Common Mistakes

Using single '=' which is assignment, not comparison.

Using 'is' which checks identity, not equality.

The equality operator == is used to compare values in conditions.

4fill in blank

hard

Fill both blanks to create a dictionary of process IDs and names for processes using more than 100 MB memory.

Cybersecurity

heavy_processes = {p.[1]: p.[2] for p in processes if p.memory > 100}

Drag options to blanks, or click blank then click option'

Apid

Bname

Cmemory

Dstatus

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'memory' as a key or value which is numeric, not an identifier or name.

Using 'status' which is unrelated to this dictionary.

The dictionary keys are process IDs (pid) and values are process names (name), filtered by memory usage.

5fill in blank

hard

Fill all three blanks to create a list of process names that started after a specific timestamp.

Cybersecurity

recent_processes = [p.[1] for p in processes if p.[2] > [3]]

Drag options to blanks, or click blank then click option'

Aname

Bstart_time

Ctimestamp

Dpid

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'pid' instead of 'name' for the list elements.

Comparing with 'pid' or 'name' instead of a time value.

The list comprehension collects process names (name) where their start time (start_time) is after a given timestamp (timestamp).