A programmer maliciously modified a production program to change data and then restored the original code.
Which of the following would MOST effectively detect the malicious activity?

A.
Comparing source code

B.
Reviewing system log files

C.
Comparing object code

D.
Reviewing executable and source code integrity

Explanation:
Reviewing system log files is the only trail that may provide information about the unauthorized activities in the
production library. Source and object code comparisons are ineffective, because the original programs were
restored and do not exist. Reviewing executable and source code integrity is an ineffective control, because
integrity between the executable and source code is automatically maintained.