hardMultiple ChoiceObjective-mapped
SSCP Practice Question: To determine how malware initially infected a…
To determine how malware initially infected a workstation, which artifact would be MOST useful?
⚠ Common exam trap
Many candidates choose web browser history (Option D) because they assume malware always arrives via the internet, but SSCP tests the understanding that process creation logs are the definitive source for identifying the first execution of any binary, regardless of delivery method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Windows Event Log showing process creation
The Windows Event Log showing process creation (Event ID 4688) provides a chronological record of every executable that ran on the system, including the parent process and command-line arguments. This allows an investigator to trace the initial execution of the malware binary, identifying the exact moment and mechanism (e.g., a dropped file, a script launch, or a scheduled task) that triggered the infection. Other artifacts may indicate persistence or lateral movement, but only process creation logs directly capture the first execution event.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Windows Event Log showing process creation
Why this is correct
Process creation events can reveal the initial executable that ran.
- ✗
Prefetch files
Why it's wrong here
Prefetch files show application execution but not the original source of the infection.
- ✗
Windows registry autorun keys
Why it's wrong here
Autorun keys indicate persistence, not initial infection vector.
- ✗
Web browser history
Why it's wrong here
Browser history may show the download but not necessarily the execution or the malware itself.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.