hardMultiple ChoiceObjective-mapped

CS0-003 Practice Question: During forensic analysis of a compromised server,…

During forensic analysis of a compromised server, the analyst finds that the attacker deleted the system logs. Which data source is most likely to still contain relevant evidence?

⚠ Common exam trap

CompTIA often tests the misconception that backup tapes are the ultimate forensic source, but the trap here is that attackers often delete logs during the incident, and only real-time, off-host telemetry (like EDR) preserves the sequence of events that occurred on the compromised host.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Endpoint detection and response (EDR) telemetry

EDR telemetry is the most reliable source because it captures process creation, network connections, file modifications, and registry changes in real-time, storing them off-host. Even if an attacker deletes local system logs, the EDR agent's telemetry stream remains intact on the central management server, providing a forensic timeline of the attacker's actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Memory dump from before the attack
Why it's wrong here
A memory dump captured before an attack would not contain any evidence of the malicious processes, network connections, or data modifications that occurred during or after the compromise. Forensic analysis requires data reflecting the system's state at the time of the incident or immediately thereafter to identify indicators of compromise (IOCs) and attacker activity. Therefore, this pre-incident snapshot is largely irrelevant for understanding the attack's specifics.
✓
Endpoint detection and response (EDR) telemetry
Why this is correct
Endpoint Detection and Response (EDR) telemetry provides granular, real-time visibility into system activities, including process execution, file modifications, registry changes, and network connections, often stored off-host in a centralized repository. This rich dataset is crucial for forensic analysis as it allows investigators to reconstruct the attack timeline, identify initial access vectors, track lateral movement, and pinpoint malicious binaries or scripts. EDR's continuous monitoring capabilities ensure that even ephemeral attacker actions are captured and available for post-incident investigation.
✗
Network flow logs
Why it's wrong here
Network flow logs, such as NetFlow or IPFIX, primarily record metadata about network communications, including source/destination IP addresses, ports, protocols, and byte counts. While useful for identifying traffic patterns and external connections, they lack the granular detail necessary to understand specific process execution, file system changes, or internal system commands executed on a compromised server. These logs cannot directly reveal which specific process initiated a connection or modified a file on the host.
✗
Backup tapes
Why it's wrong here
Backup tapes are primarily designed for data recovery and business continuity, capturing system states at specific, often scheduled, intervals. While they contain copies of files and potentially some logs, they are unlikely to hold the most recent, critical forensic evidence or real-time logs from the period immediately surrounding the compromise. Furthermore, restoring data from tapes for forensic analysis is a time-consuming process and the restored data might not reflect the exact state of the system at the time of the attack.

Go deeper

CS0-003 Practice Question: During forensic analysis of a compromised server,…

Why each option matters

Option-by-option breakdown

Related to this question