Question

File system and registry changes can indicate or suggest a security breach, or attack has occurred. An attacker may change critical system configuration stored in system files or registry keys to change or disable essential security settings or store malware and scripts.

Which of the following are signs that might indicate a security breach or attack on a file system? (Select two.)

answer

The removal of temp files or deleting log entries.


Installation of DNS server or a web server on a host machine.


The creation of new files or folders in unexpected locations or with unusual names.


Use of a hypervisor to run unauthorized software.


Use of a host file for a pharming attack.

Answer 1

- The removal of temp files or deleting log entries.
- The creation of new files or folders in unexpected locations or with unusual names.

These are common file‑system indicators of compromise (attackers often create new files/folders and clean up logs/temp files to hide activity).