CRISC Domain 3 Risk Response and Mitigation Practice Test 2026 - Free CRISC Practice Questions and Study Guide

The most effective method for detecting malware in a system is by reviewing changes to file size. Malware often operates by creating, modifying, or deleting files on a system. When analyzing file sizes, any unexpected alterations can indicate the presence of malware. For instance, a significant increase in file size may suggest that a malware program has embedded itself into an existing file or has created a new file that consumes resources. This method allows for a direct examination of potentially suspicious changes that could signify the presence or activity of malicious software.

Reviewing administrative-level changes, audit logs, and incident logs can provide valuable information and context about system operations and security incidents, but they may not directly point to the presence of malware like monitoring file size changes can. Administrative changes involve legitimate configuration modifications, while audit and incident logs provide historical data that may not reflect real-time malware activity. Therefore, focusing on file size changes is a more proactive approach to identifying potential malware infections within the system.