Identifying File Creator and Creation Date

SY0-701 By islever Editorial Last updated

Short answer

D Query the file's metadata.

Question

A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file's creator. Which of the following actions would most likely give the security analyst the information required?
  1. Obtain the file's SHA-256 hash.
  2. Use hexdump on the file's contents.
  3. Check endpoint logs.
  4. Query the file's metadata. Correct Answer

Key Takeaways

The question tests knowledge of digital forensics basics, specifically distinguishing between content analysis and attribute inspection, while avoiding the trap of confusing hash values with descriptive data.

Querying file metadata is the primary method for retrieving creation dates and author information. Community consensus confirms that metadata provides direct descriptive data about a file's origin.

Expert Analysis

Why the Answer Is Correct

Querying the file's metadata (Option D) is the correct action because metadata contains specific attributes such as creation date, modification date, and author/creator information. For video files, this often includes EXIF or similar tags embedded by the recording software or device.

Why the Other Options Are Wrong

SHA-256 hashes (Option A) provide a unique fingerprint for integrity verification but contain no human-readable details about the file's history. Hexdump (Option B) displays raw binary data; while some metadata might be visible in plaintext within the hex stream, it is not the most efficient or reliable method for extracting structured creator info. Endpoint logs (Option C) track system events like file access or creation times but typically do not store the original file creator identity unless specific auditing policies were already in place.

Community Comment Notes

Comment [1] correctly defines metadata as 'data that describes other data,' highlighting its role in forensic analysis. Comment [2] emphasizes efficiency, noting that querying metadata is the most direct way to gather required details without parsing raw content.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. geocis 👍 6
    Answer D......Metadata is data that describes other data, such as its format, origin, creation date, author, and other attributes. Video files, like other types of files, can contain metadata that can provide useful information for forensic analysis.
  2. dbrowndiver 👍 3 Answered D
    In this scenario, choice "D" is correct. Query the file's metadata is the correct answer because metadata provides direct information about the file's creation date and possibly the creator. This method is the most efficient and effective way to gather the required details about a potentially malicious video file. By querying the file's metadata, the security analyst can access information about when the file was created and potentially who created it, assuming the creator's details were embedded or tagged during the file's creation.
  3. Shaman73 👍 5
    D. Query the file's metadata.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide