What is the first place to check if you believe your system has been hacked?

What is the first place to check if you believe your system has been hacked?

• A. BIOS settings
• B. System log files
• C. Documents
• D. USB drives

Answer: (B)

When you suspect a hack, the first place to check is the system log files. Logs capture what happened on the system: who logged in, from where, and when; which accounts were created or changed; which services started or stopped; and what network connections or processes appeared. This gives you a timeline of events and concrete evidence of any suspicious activity, helping you identify if an intrusion occurred and where to focus your investigation. BIOS/UEFI settings could reveal a highly sophisticated firmware compromise, but such changes are less common and require specialized analysis; they’re not the typical starting point for initial triage. Documents and USB drives might be involved in an attack, but they don’t provide the immediate, system-wide evidence of compromise that logs do, so they aren’t the best first check.

When you suspect a hack, the first place to check is the system log files. Logs capture what happened on the system: who logged in, from where, and when; which accounts were created or changed; which services started or stopped; and what network connections or processes appeared. This gives you a timeline of events and concrete evidence of any suspicious activity, helping you identify if an intrusion occurred and where to focus your investigation.

BIOS/UEFI settings could reveal a highly sophisticated firmware compromise, but such changes are less common and require specialized analysis; they’re not the typical starting point for initial triage. Documents and USB drives might be involved in an attack, but they don’t provide the immediate, system-wide evidence of compromise that logs do, so they aren’t the best first check.