A programmer maliciously modified a production program to change data and then restored the
original code. Which of the following would MOST effectively detect the malicious activity?

A.
Comparing source code

B.
Reviewing system log files

C.
Comparing object code

D.
Reviewing executable and source code integrity

Explanation:

Reviewing system log files is the only trail that may provide information about the unauthorized
activities in the production library. Source and object code comparisons are ineffective, because
the original programs were restored and do not exist. Reviewing executable and source code
integrity is an ineffective control, because integrity between the executable and source code is
automatically maintained.