CompTIA CASP+ (CAS-004) — Question 447

An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user’s credentials. However, it is unclear if the system baseline was modified to achieve persistence. Which of the following would most likely support forensic activities in this scenario?

Answer options

Correct answer: B

Explanation

Bit-level disk duplication is the best choice because it allows for an exact copy of the disk to be created for analysis, preserving all data and potential evidence of modifications made by the attacker. The other options, while useful in different contexts, do not provide the same level of detailed forensic information needed to determine if the system baseline has been altered.