A Security Analyst Is Investigating a Malware Infection That Occurred

question 127

Multiple Choice

A security analyst is investigating a malware infection that occurred on a Windows system. The system was not connected to a network and had no wireless capability. Company policy prohibits using portable media or mobile storage. The security analyst is trying to determine which user caused the malware to get onto the system. Which of the following registry keys would MOST likely have this information?

• A) HKEY_USERS\<user SID>\Software\Microsoft\Windows\CurrentVersion\Run
• B) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• C) HKEY_USERS\<user SID>\Software\Microsoft\Windows\explorer\MountPoints2
• D) HKEY_USERS\<user SID>\Software\Microsoft\Internet Explorer\Typed URLs
• E) HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\System\iusb3hub

---

Definitions:

Social Control

Mechanisms, strategies, or institutions employed by a society to regulate individual behavior and enforce conformity to societal norms and laws.

Civil Unrest

A broad term used to describe situations where groups of people come together to protest or act against established authority or policies, often leading to disorder.

Mass Unemployment

A situation in which a large portion of the workforce is unable to find employment, often due to economic downturns or industrial changes.

Elected Leaders

Individuals chosen through a voting process to hold positions of authority and governance in an organization or government.