Câu 22: CAS-003: CompTIA Advanced Security Practitioner (CASP) CAS-003

A forensics analyst suspects that a breach has occurred. Security logs show the company's OS patch system may be compromised, and it is serving patches that contain a zero-day exploit and backdoor. The analyst extracts an executable file from a packet capture of communication between a client computer and the patch server. Which of the following should the analyst use to confirm this suspicion?

1. A. File size
2. B. Digital signature — đáp án hiện tại
3. C. Checksums
4. D. Anti-malware software
5. E. Sandboxing