Which term describes the process of capturing the system state at the start of malware analysis?

• A. Baselining
• B. Host integrity monitoring
• C. Netstat
• D. Strings

Answer: (A)

Baselining is the practice of capturing a reference snapshot of a system’s state at a known point in time, usually at the start of malware analysis. This initial capture includes running processes, open network connections, startup items, loaded modules, registry keys, file hashes, and other indicators of normal operation. Having this baseline makes it possible to compare future data and quickly spot deviations caused by malware, such as new processes, unfamiliar connections, altered files, or changed registry entries, which helps map the malware’s activity and persistence.

Other options don’t fit this specific purpose. Host integrity monitoring is ongoing, continuous monitoring for changes rather than a one-time initial snapshot. Netstat shows current network connections, not a comprehensive snapshot of the system state. Strings scans binaries for readable text, which is unrelated to recording the system’s baseline.