312-49V11 · Question #162
During a forensic investigation of a compromised system, the investigator is analyzing various forensic artifacts to determine the nature and scope of the attack. The investigator is specifically…
The correct answer is D. Log file anomalies that provide detailed records of events and errors on the device. This question aligns directly with CHFI v11 objectives under Computer Forensics Fundamentals and Log Analysis. Log files are among the most critical forensic artifacts because they provide a chronological and authoritative record of system, security, and application events…
Question
During a forensic investigation of a compromised system, the investigator is analyzing various forensic artifacts to determine the nature and scope of the attack. The investigator is specifically looking for information related to failed sign-in attempts, security policy changes, alerts from intrusion detection systems, and unusual application malfunctions. Which type of forensic artifact is most likely to contain this critical information?
Options
- ACryptographic artifacts that store information about encryption and decryption operations.
- BBrowser artifacts that track user browsing history and website interactions.
- CProcess and memory artifacts that contain information about running processes and system
- DLog file anomalies that provide detailed records of events and errors on the device.
How the community answered
(24 responses)- A4% (1)
- B4% (1)
- C13% (3)
- D79% (19)
Explanation
This question aligns directly with CHFI v11 objectives under Computer Forensics Fundamentals and Log Analysis. Log files are among the most critical forensic artifacts because they provide a chronological and authoritative record of system, security, and application events. CHFI v11 emphasizes that logs are essential for reconstructing attack timelines, identifying unauthorized access attempts, and determining the scope of a compromise. Artifacts such as failed sign-in attempts, security policy modifications, IDS alerts, and application errors are routinely recorded in log sources including Windows Security logs, system logs, application logs, firewall logs, and IDS/IPS logs. These logs allow investigators to correlate events across systems, identify brute-force attacks, detect privilege escalation, and recognize abnormal behavior caused by malware or misconfiguration. Cryptographic artifacts focus on key usage and encryption operations, browser artifacts relate to user web activity, and process or memory artifacts provide insight into live execution states--but none provide the comprehensive, event-based historical visibility required to answer all aspects of the question. CHFI v11 highlights log analysis as the primary method for understanding what happened, when it happened, how it happened, and who was involved. Therefore, log file anomalies are the most relevant and reliable forensic artifacts in this scenario.
Topics
Community Discussion
No community discussion yet for this question.