nerdexam
Cisco

350-201 · Question #28

A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The…

The correct answer is A. Run the sudo sysdiagnose command. https://eclecticlight.co/2016/02/06/the-ultimate-diagnostic-tool-sysdiagnose/

Host-Based Analysis

Question

A Mac laptop user notices that several files have disappeared from their laptop documents folder. While looking for the files, the user notices that the browser history was recently cleared. The user raises a case, and an analyst reviews the network usage and discovers that it is abnormally high. Which step should be taken to continue the investigation?

Options

  • ARun the sudo sysdiagnose command
  • BRun the sh command
  • CRun the w command
  • DRun the who command

How the community answered

(33 responses)
  • A
    82% (27)
  • B
    6% (2)
  • C
    3% (1)
  • D
    9% (3)

Explanation

https://eclecticlight.co/2016/02/06/the-ultimate-diagnostic-tool-sysdiagnose/

Topics

#macOS forensics#sysdiagnose#host investigation#data exfiltration indicators

Community Discussion

No community discussion yet for this question.

Full 350-201 Practice