Why would an incident handler acquire memory on a system being investigated?

exams GCED GCED exam 0 Comments

Why would an incident handler acquire memory on a system being investigated?
A . To determine whether a malicious DLL has been injected into an application
B . To identify whether a program is set to auto-run through a registry hook
C . To list which services are installed on they system
D . To verify which user accounts have root or admin privileges on the system

Answer: C