Skip to main content

Quiz - Module 11: Memory & Review

Test your knowledge on memory management and synchronization!

Question 1​

What is virtual memory?

  • A) Extra RAM
  • B) An abstraction that gives each process its own address space
  • C) A virus
  • D) A hard drive
See the answer

Answer: B) An abstraction for the address space

Virtual memory isolates processes and allows exceeding physical RAM.

Question 2​

What is the swap/pagefile?

  • A) A virus
  • B) Disk space used as an extension of RAM
  • C) A temporary file
  • D) A protocol
See the answer

Answer: B) Disk space used as an extension of RAM

Swap moves less-used memory pages to the disk.

Question 3​

What is a memory page?

  • A) A file
  • B) A fixed-size block used for memory management
  • C) A virus
  • D) A protocol
See the answer

Answer: B) A fixed-size block used for memory management

Pages are the basic unit of virtual memory (often 4 KB).

Question 4​

What is a page fault?

  • A) A fatal error
  • B) Access to a page not present in physical RAM
  • C) A virus
  • D) A protocol
See the answer

Answer: B) Access to a page not present in physical RAM

The system must then load the page from the disk.

Question 5​

What is the heap?

  • A) A virus
  • B) The memory area for dynamic allocations
  • C) A file
  • D) A protocol
See the answer

Answer: B) The memory area for dynamic allocations

The heap stores objects allocated with malloc/new.

Question 6​

What is the stack?

  • A) A virus
  • B) The memory area for local variables and function calls
  • C) A file
  • D) A protocol
See the answer

Answer: B) The memory area for local variables

The stack manages function calls and local variables (LIFO).

Question 7​

What is a memory leak?

  • A) Leaking RAM
  • B) Allocated memory that is never freed
  • C) A virus
  • D) A protocol
See the answer

Answer: B) Allocated memory that is never freed

Memory leaks gradually consume all available RAM.

Question 8​

Which Sysinternals tool analyzes process memory?

  • A) Process Explorer
  • B) VMMap
  • C) Autoruns
  • D) TCPView
See the answer

Answer: B) VMMap

VMMap visualizes detailed memory usage of a process.

Question 9​

What is Volatility?

  • A) A virus
  • B) A forensic memory analysis framework
  • C) A browser
  • D) An antivirus
See the answer

Answer: B) A forensic memory analysis framework

Volatility analyzes memory dumps for forensics.

Question 10​

What is a memory dump?

  • A) A virus
  • B) A snapshot of the memory state at a given time
  • C) A configuration file
  • D) A protocol
See the answer

Answer: B) A snapshot of the memory state

Dumps allow forensic analysis and debugging.

Question 11​

What is DLL injection?

  • A) Only a virus
  • B) Inserting code into a process via a DLL
  • C) A protocol
  • D) A file
See the answer

Answer: B) Inserting code into a process via a DLL

DLL injection is used both legitimately and maliciously.

Question 12​

What is process hollowing?

  • A) An empty process
  • B) A technique that replaces the code of a legitimate process
  • C) A protocol
  • D) A file
See the answer

Answer: B) A technique that replaces the code of a legitimate process

Malware hides in the shell of a legitimate process.

Question 13​

What is ASLR?

  • A) A virus
  • B) Address Space Layout Randomization - address randomization
  • C) A protocol
  • D) A file
See the answer

Answer: B) Address Space Layout Randomization

ASLR makes exploits more difficult by randomizing addresses.

Question 14​

What is DEP?

  • A) A virus
  • B) Data Execution Prevention - prevents data execution
  • C) A protocol
  • D) A file
See the answer

Answer: B) Data Execution Prevention

DEP prevents code execution in data areas.

Question 15​

What is a race condition?

  • A) A speed competition
  • B) A bug where the result depends on the execution order of threads
  • C) A virus
  • D) A protocol
See the answer

Answer: B) A bug dependent on execution order

Race conditions cause unpredictable behaviors.

Question 16​

What is a critical section?

  • A) An important file
  • B) A portion of code that accesses shared resources
  • C) A virus
  • D) A protocol
See the answer

Answer: B) A portion of code that accesses shared resources

Critical sections must be protected by locks.

Question 17​

Which Windows API creates a mutex?

  • A) MakeMutex
  • B) CreateMutex
  • C) NewMutex
  • D) InitMutex
See the answer

Answer: B) CreateMutex

CreateMutex creates a mutex synchronization object.

Question 18​

Which function waits for an object to be signaled?

  • A) Wait
  • B) WaitForSingleObject
  • C) Sleep
  • D) Pause
See the answer

Answer: B) WaitForSingleObject

WaitForSingleObject waits for a mutex/event to be available.

Question 19​

What is a Windows event?

  • A) A virus
  • B) A synchronization object to signal events
  • C) A file
  • D) A protocol
See the answer

Answer: B) A synchronization object to signal events

Events allow one thread to signal another.

Question 20​

What is the Working Set of a process?

  • A) Open files
  • B) Memory pages currently in physical RAM
  • C) A virus
  • D) A protocol
See the answer

Answer: B) Memory pages currently in physical RAM

The Working Set is the physical memory used by the process.

Question 21​

What is committed memory?

  • A) A virus
  • B) Memory reserved and guaranteed by the system
  • C) A file
  • D) A protocol
See the answer

Answer: B) Memory reserved and guaranteed by the system

Committed memory can be in RAM or in swap.

Question 22​

How to detect malware in memory?

  • A) Scan files
  • B) Analyze processes, injected DLLs, hooks, and anomalies
  • C) Restart
  • D) Format
See the answer

Answer: B) Analyze processes, DLLs, and anomalies

Tools like Process Explorer and Volatility detect anomalies.

Question 23​

What is a hook?

  • A) Only a virus
  • B) Interception of function calls or messages
  • C) A file
  • D) A protocol
See the answer

Answer: B) Interception of function calls or messages

Hooks can be legitimate or malicious.

Question 24​

Which tool detects rootkits?

  • A) Notepad
  • B) GMER or RootkitRevealer
  • C) Paint
  • D) Calculator
See the answer

Answer: B) GMER or RootkitRevealer

These tools detect hidden system modifications.

Question 25​

What is paging?

  • A) A book
  • B) The mechanism for managing memory pages
  • C) A virus
  • D) A protocol
See the answer

Answer: B) The mechanism for managing memory pages

Paging enables virtual memory and swap.

Question 26​

What is the TLB?

  • A) A virus
  • B) Translation Lookaside Buffer - cache for address translations
  • C) A file
  • D) A protocol
See the answer

Answer: B) Translation Lookaside Buffer

The TLB speeds up virtual/physical address translation.

Question 27​

How does Windows protect kernel memory?

  • A) By password
  • B) By protection rings (ring 0 vs ring 3)
  • C) By encryption only
  • D) It does not protect it
See the answer

Answer: B) By protection rings

Ring 0 (kernel) is isolated from Ring 3 (user mode).

Question 28​

What is the PEB?

  • A) A virus
  • B) Process Environment Block - process info structure
  • C) A file
  • D) A protocol
See the answer

Answer: B) Process Environment Block

The PEB contains information about the process in user mode.

Question 29​

What is the garbage collector?

  • A) A waste collector
  • B) An automatic memory release mechanism
  • C) A virus
  • D) A protocol
See the answer

Answer: B) An automatic memory release mechanism

The GC automatically frees unused memory (Java, .NET, Python...).

Question 30​

Why is memory forensics important?

  • A) To speed up the PC
  • B) To analyze malware and evidence that only exist in memory
  • C) To format
  • D) To install programs
See the answer

Answer: B) To analyze malware and evidence in memory

Some evidence and fileless malware only exist in RAM.

Score​

ScoreLevel
27-30Excellent!
22-26Very good!
17-21Good
12-16Fair
0-11Needs review

Quiz for Module 11 - Memory & Review - 30 questions