CompTIA SecurityX (CAS-005) CAS-005 — Question 311

During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing: • Source of the malicious files • Initial attack vector • Lateral movement activities The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort?