Security Operations →hardMultiple SelectObjective-mapped

CAS-004 Security Operations Practice Question

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Windows Event Logs

Timestamps from the MFT (Master File Table), prefetch files, and event logs are key to establishing a timeline. Prefetch shows program execution, MFT shows file access/modification, and event logs record system events. The registry contains configuration data but not as reliable for timeline; SRUM is for resource usage but less direct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Registry hives
Why it's wrong here
Registry stores configuration, not a direct timeline.
✓
Windows Event Logs
Why this is correct
Event logs record security and system events.
✓
Master File Table (MFT)
Why this is correct
MFT contains timestamps for file activity.
✓
Prefetch files
Why this is correct
Prefetch files record execution times of applications.
✗
System Resource Utilization Monitor (SRUM)
Why it's wrong here
SRUM tracks resource usage but is less reliable for timeline.

Go deeper

CAS-004 Security Operations Practice Question

Why each option matters

Option-by-option breakdown

Related to this question