Exam CFR-310 topic 1 question 22 discussion

B. lsof Explanation: lsof (List Open Files) is a command that displays information about files that are currently open by active processes. It can be used to track which files a particular user has opened, which is crucial for investigating unauthorized access to sensitive data. Why the other answers are incorrect: A. ls: Lists files in a directory but does not provide information on which files are currently open or accessed by a user. C. ps: Shows information about running processes, but not which files those processes have opened. D. netstat: Displays network connections and routing tables, but does not provide details on file access.

The answer is B. lsof. The lsof command is a Linux command that lists all open files on the system. This includes files that are opened by processes, sockets, and other file descriptors. In this case, the security investigator can use the lsof command to determine which files have been opened by the unauthorized insider.