During an incident response activity, the response team collected some artifacts from a compromised server,...

CompTIA CAS-005 Question Answer

During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing:

• Source of the malicious files

• Initial attack vector

• Lateral movement activities

The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort?

Executing decompilation of binary files

Analyzing all network routes and connections

Performing primary memory analysis

Collecting operational system logs and storage disk data

CAS-005 PDF/Engine

Get 65% Discount on All Products, Use Coupon: "ac4s65"