200-201 Question 187
Select 3A cybersecurity analyst is investigating a potential malware infection on a Windows system. The analyst notices unusual processes running and wants to identify critical operating system components to determine if they have been compromised. Which of the following are core components of the Windows operating system that should be verified for integrity?
- A
Kernel32.dll
- B
Syslog
- C
Registry
- D
Task Scheduler
- E
Grub
Show answer and explanation
Correct answers: A, C, D
Explanation
Kernel32.dll, the Registry, and Task Scheduler are critical components of the Windows operating system and should be checked for integrity when investigating a potential malware infection. Syslog and Grub are Linux-related components and are not relevant in this Windows-specific scenario.
- A. Correct.
Kernel32.dll is a critical Windows system file that handles memory management, process creation, and input/output operations, making it vital for the operating system's functionality.
- B. Incorrect.
Syslog is a logging service used primarily in Linux and Unix-based systems, not Windows, so it is not relevant in this scenario.
- C. Correct.
The Registry is a core component of Windows, as it stores configuration settings and options for the operating system and installed applications.
- D. Correct.
Task Scheduler is a Windows feature that allows tasks to be performed automatically at specified times, and its integrity is essential for system operations.
- E. Incorrect.
Grub is a boot loader used in Linux systems and is not part of the Windows operating system.