300-215 Question 72
Select 3During an incident response investigation, you suspect that a malicious actor has exfiltrated sensitive data from a compromised host. Which of the following files and their respective locations on the host should you prioritize for forensic analysis to validate this suspicion?
- A
System log files located in /var/log/ (Linux) or C:\Windows\System32\Winevt\Logs\ (Windows)
- B
Browser cache and history files located in user-specific directories such as ~/.mozilla/firefox/ or C:\Users<username>\AppData\Local\Google\Chrome\
- C
Process memory dumps located in /proc/
/mem (Linux) or created manually via tools like Task Manager or Sysinternals in Windows - D
Network packet captures stored in files such as .pcap or .pcapng, typically collected using tools like tcpdump or Wireshark
- E
Backup files stored in directories such as /backup/ (Linux) or C:\Backup\ (Windows)
Show answer and explanation
Correct answers: A, B, D
Explanation
To determine if sensitive data was exfiltrated from a host, forensic analysts must focus on files that can provide evidence of attacker activities related to data movement and access. System logs, browser data, and network packet captures are highly relevant as they can collectively reveal unauthorized access, suspicious activity, and outbound data transfers. While other options like process memory dumps and backup files may be useful in other contexts, they are less directly tied to confirming data exfiltration.
- A. Correct.
System log files can provide evidence of unauthorized access, privilege escalation, or system modifications, making them crucial for forensic analysis.
- B. Correct.
Browser cache and history files can reveal if the attacker used the browser to exfiltrate data, access malicious sites, or perform other suspicious activities.
- C. Incorrect.
Process memory dumps are useful for analyzing malware behavior or extracting encryption keys but are less directly relevant to identifying data exfiltration.
- D. Correct.
Network packet captures can show evidence of data exfiltration by displaying large or suspicious outbound traffic patterns.
- E. Incorrect.
Backup files may contain sensitive data but are not directly related to identifying the exfiltration activity or its evidence on the host.