A host was infected with malware. During the incident response, Joe, a user, reported that he did not receive any emails with links, but he had been browsing the Internet all day. Which of the following would MOST likely show where the malware originated?
A) The DNS logs
B) The web server logs
C) The SIP traffic logs
D) The SNMP logs

Question

Quizplus · Accepted Answer

DNS logs would most likely show where the malware originated because they can provide information about the domain names that were resolved during Joe's internet browsing, potentially identifying malicious sites that were accessed.

A Host Was Infected with Malware