Which of the following commands could the investigator use to determine which files have been opened by this user?

exams CFR-410 CFR-410 exam 0 Comments

A security investigator has detected an unauthorized insider reviewing files containing company secrets.

Which of the following commands could the investigator use to determine which files have been opened by this user?
A . ls
B. lsof
C. ps
D. netstat

Answer: B