Câu 171: CS0-003: CompTIA CySA+ (CS0-003)

An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on its infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause? (Choose two.)

1. A. Creation time of dropper
2. B. Registry artifacts — đáp án hiện tại
3. C. EDR data
4. D. Prefetch files
5. E. File system metadata — đáp án hiện tại
6. F. Sysmon event log