Computer Hacking Forensic Investigator (CHFI) — Question 38

Profiling is a forensics technique for analyzing evidence with the goal of identifying the perpetrator from their various activity. After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?

Answer options

• A. The manufacturer of the system compromised
• B. The logic, formatting and elegance of the code used in the attack
• C. The nature of the attack
• D. The vulnerability exploited in the incident

Correct answer: B

Explanation

The correct answer is B because the code's logic, formatting, and elegance can reveal the skill level and intent of the attacker, which is vital for profiling. Options A and C provide less insight into the attacker's capabilities, while D focuses on the technical aspect of the breach rather than the attacker's profile.