Endpoint artifacts are crucial for uncovering undetected threats. Which of the following are considered endpoint artifacts? (Choose two)

Question

Options

• ARouter configuration files
• BWindows Registry keys
• CBash history in Linux
• DDNS server logs

• A
  3% (1)
• B
  94% (33)
• D
  3% (1)

Explanation

Windows Registry keys and Bash history are endpoint artifacts because they reside directly on the end-user device - the Registry stores configuration and persistence data on Windows machines (a favorite hiding spot for malware via Run keys), while Bash history captures every command executed on a Linux system, making both invaluable for detecting attacker activity on the host itself.

Router configuration files (A) are network infrastructure artifacts tied to network devices, not end-user endpoints. DNS server logs (D) are generated by a server-side network service, not on any individual endpoint - they belong to network-based forensic analysis.

Memory tip: Think of "endpoint" as the device a user physically touches - a Windows PC or Linux workstation. If the artifact lives on that machine (Registry, shell history, prefetch files, event logs), it's an endpoint artifact. If it lives on a shared network device (router, DNS server, firewall), it's a network artifact.

No community discussion yet for this question.