Exam GCIH All QuestionsBrowse all questions from this exam
Question 196

Considering Volatility, why would psscan return more results than pslist?

    Correct Answer: D

    The psscan plugin identifies hidden processes, which is why it would return more results than pslist. While pslist relies on the active process list maintained by the operating system, psscan performs a more thorough scan of memory, including areas where hidden or terminated processes might reside. This allows psscan to detect and list processes that do not appear in the standard process list used by pslist.

Discussion
samdwiseOption: D

Answer is D. The psscan plugin identifies hidden processes

RezaeeOption: C

C. The psscan plugin can access a list of processes directly from the kernel.