Camila, a system administrator, is tasked with investigating web traffic logs on a Windows-based server running IIS (Internet Information Services). She needs to find the location of the IIS log files in order to analyze the requests made to the server. Which of the following paths should Camila check to find the IIS log files?

• A. /usr/local/etc/apache22/httpd.conf
• B. /etc/httpd/conf/httpd.conf
• C. /etc/apache2/apache2.conf
• D. %SystemDrive%\inetpub

Ryan, a computer forensic investigator, was tasked with a case involving the illegal dissemination of confidential data within a large corporation. The suspected employee worked in an office where everyone had access to a Network Attached Storage (NAS) device, making it an area of interest.
The NAS used a Linux-based filesystem. A recent upgrade led to a complete wipe and restoration of the data on the NAS. To complicate matters, the corporation also had a Storage Area Network (SAN) in use, suspected to be another source of confidential data leakage. Understanding the idiosyncrasies of NAS and SAN storage systems, what is the best approach for Ryan to begin his investigation?

• A. Ryan should focus on the SAN first, as it is likely the source of larger data leaks.
• B. Ryan should aim to reconstruct the RAID configurations, if any, of the NAS and SAN systems before attempting data recovery.
• C. Ryan should immediately create a physical image of both NAS and SAN devices.
• D. Ryan should recover deleted files from the NAS device using a popular Windows-based recovery tool.

In a multinational corporation, there have been increasing reports of system crashes and data leaks from the intranet. Forensic investigators discovered a highly polymorphic worm propagating across the network. The worm quickly changes its structure, making it difficult to analyze its behavior and create signatures. Susan, a cybersecurity analyst, needs to conduct a behavioral analysis of the worm in a secure and controlled environment. Which of the following tools should she use for this purpose?

• A. Cuckoo Sandbox
• B. IDA Pro
• C. Process Monitor
• D. Wireshark

During a targeted intrusion at a financial firm in Seattle, Washington, a forensic analyst must determine which log source can best help identify the initial inbound connection used by the attacker. The analyst has access to multiple network device logs - some showing packet rejections, others displaying decoy interactions, DHCP lease history, and intrusion alerts. Which log type should the analyst prioritize to trace the first connection attempt to the organization's internal host?

• A. DHCP logs
• B. Firewall logs
• C. IDS logs
• D. Honeypot logs