After suspected malware on a clerk PC, which telemetry best answers which process spawned and which files were written?
Select an answer to reveal the explanation.
Short Explanation
The firewall saw cars on the highway; it did not see who opened the filing cabinet. Process creation and file writes live on the clerk PC—EDR and endpoint logs, not perimeter denies or pump-station gauges.
Full Explanation
After suspected malware on a clerk PC, the questions which process spawned and which files were written are host-execution and file-activity questions. EDR or endpoint logs that record process creation and file writes on that host are the right telemetry: parent and child process, command line, file path, hashes, and often user context. Those fields let a municipal SOC reconstruct the intrusion recipe on the workstation. Perimeter and unrelated civic systems cannot invent a process tree they never saw.
Perimeter firewall denies without host process fields fail by layer—they show blocked or allowed network attempts, not which binary spawned or which paths were written on the clerk PC. Municipal website CMS publish history documents who published web content, not endpoint malware behavior. Wastewater historian analog values report pump and process measurements and carry no process-creation semantics for IT endpoints.
Exam caveat: process and file questions require endpoint or EDR (or equivalent host logging); network denies and OT analog data are recurring distractors on SPLK-5001.
Operational check: pull EDR process and file events for the clerk hostname in the incident window, note parent process and written paths, hash suspicious binaries against Enterprise Security threat lists, and use firewall logs only as secondary egress context after the host story is clear.