Which method is used to analyze RAM dumps to detect rootkits?

• A. Cross View-Based Detection
• B. Runtime Execution Path Profiling
• C. Analyzing Memory Dumps
• D. Alternative Trusted Medium

Answer: (C)

Rootkits hide in memory and can operate outside of what’s stored on disk, so examining volatile data through RAM dumps is the direct way to uncover them. Analyzing memory dumps lets you inspect running processes, loaded drivers, kernel objects, and memory-resident code, including hooks, modified system call tables, and hidden modules. This view reveals discrepancies such as rogue threads, modules that exist in memory but not on disk, and injected code patches, which are common indicators of a memory-residing rootkit.

Other approaches aren’t specifically about RAM analysis. They may focus on comparing different system views or profiling execution paths, which don’t directly expose the hidden memory artifacts a RAM dump analysis reveals.