Exam GCIH All QuestionsBrowse all questions from this exam
Question 104

Which volatility plugin shows the command line path for a recently launched application?

    Correct Answer: C

    The correct plugin in Volatility to show information about the command line path for a recently launched application is 'pslist'. This plugin lists the active processes on the system, and provides details such as the process ID, parent process ID, and in some configurations, the command line used to start the process. The other options ('hivelist', 'dlllist', and 'netscan') do not provide information about the command line paths for applications.

Discussion
847ch0n3

None, it's CmdLine

chuzpahOption: C

The Pslist plugin lists processes, Netscan shows networking (active network connections and sockets)

chuzpahOption: C

PSlist Book 2 Page 72

XBal

Correct answer is CmdLine but that is not listed in the options