Exam SC-200 topic 5 question 7 discussion

Here’s a breakdown of the options: Processes: This would show active processes at the time of the collection but not historical execution data. Autoruns: This includes programs that are configured to run during system boot or login, which might not necessarily indicate when a file was executed. Security event log: While this log contains a record of security-related events, it may not specifically track the execution times of individual executables unless auditing is configured to do so. Scheduled tasks: This would show tasks that are scheduled to run automatically, which could include File1.exe if it was set up as a task, but it wouldn’t provide historical execution data. Prefetch files (E): These files are specifically designed to track program execution information and would contain the data needed to determine when File1.exe was first and last run.

E: The timestamps of a prefetch file are arguably the most beneficial aspect of the file itself. The creation date of a prefetch file is the first time that an executable was ran on a system, while the modification date of a prefetch file is the last time that an executable was ran on a system.