CompTIA CASP+ (CAS-003) — Question 119

A laptop is recovered a few days after it was stolen.
Which of the following should be verified during incident response activities to determine the possible impact of the incident?

Answer options

• A. Full disk encryption status
• B. TPM PCR values
• C. File system integrity
• D. Presence of UEFI vulnerabilities

Correct answer: D

Explanation

Verifying the Presence of UEFI vulnerabilities is crucial as these can indicate potential security flaws that may have been exploited during the theft. The other options, while important for overall security, do not specifically address the immediate risks associated with unauthorized access that could have occurred while the laptop was missing.