Exam SY0-601 topic 1 question 373 discussion

Actual exam question from CompTIA's SY0-601

Question #: 373
Topic #: 1

A malicious actor recently penetrated a company's network and moved laterally to the data center. Upon investigation, a forensics firm wants to know what was in the memory on the compromised server. Which of the following files should be given to the forensics firm?

A. Security
B. Application
C. Dump
D. Syslog

Show Suggested Answer

Suggested Answer: C 🗳️

by [deleted] at Feb. 7, 2023, 9:34 p.m.

Comments

Submit Cancel

NerdAlert

Highly Voted 2 years, 3 months ago

Selected Answer: C

They should take a Dump for further analysis :D

upvoted 21 times

...

ApplebeesWaiter1122

Highly Voted 2 years ago

Selected Answer: C

A memory dump is a snapshot of the contents of the system's memory at a specific point in time. It includes information such as running processes, open network connections, and other data residing in the RAM of the compromised server. By analyzing the memory dump, the forensics firm can identify any malicious processes, artifacts, or indicators of compromise that can help in understanding the extent of the attack and the actions taken by the malicious actor.

upvoted 14 times