A Security Analyst Is Investigating a Malware Infection That Occurred

question 127

Multiple Choice

A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability. Company policy prohibits using portable media or mobile storage. The security analyst is trying to determine which user caused the malware to get onto the system. Which of the following registry keys would MOST likely have this information?

• A) HKEY_USERS\<user SID>\Software\Microsoft\Windows\CurrentVersion\Run
• B) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• C) HKEY_USERS\<user SID>\Software\Microsoft\Windows\explorer\MountPoints2
• D) HKEY_USERS\<user SID>\Software\Microsoft\Internet Explorer\Typed URLs
• E) HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub

---

Definitions:

Employee Retention

The strategies and practices employed by a business to prevent key employees from leaving their jobs.

Hiring Terms

The conditions upon which an employer hires an employee, including contract duration, job responsibilities, salary, and benefits.

High Turnover

A situation where an organization or industry experiences a high rate of employees leaving and needing replacement over a given period.

Excessive Hours

Working hours that exceed the standard legal or culturally accepted normal working hours, potentially leading to health issues and reduced work-life balance.