5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is profiling a server and finds that the application 'FileZilla Server' is installed, but the process is not running. The server is listening on port 21. What is the most likely explanation?

   • AThe FileZilla Server is installed but not running, and port 21 is used by a malicious process.
   • BThe FileZilla Server service is disabled, and another FTP server is listening on port 21.
   • CThe server is using port 21 for a different protocol, such as SSH.
   • DThe FileZilla Server is running as a different process name.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In server profiling, what is the primary purpose of identifying service accounts?

   • ATo list all installed software packages.
   • BTo determine the physical hardware specifications of the server.
   • CTo check the server's network bandwidth usage.
   • DTo understand which automated services run under specific credentials.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is profiling a Linux server and sees a process named 'apache2' running as root. The analyst also notices that the server is listening on port 80. What is the most significant security concern?

   • AThe server should be immediately isolated from the network.
   • BThe apache2 process might be a malware masquerading as a legitimate service.
   • CThe server is listening on port 80, which is a common target for attackers.
   • DThe apache2 process is running as root, which could lead to privilege escalation if the web server is compromised.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a server profiling exercise, an analyst examines a Windows server and finds a scheduled task that runs a script as the `svc_backup` account. The analyst also sees that `svc_backup` is currently logged on. What should the analyst infer about this server?

   • AThe `svc_backup` account should be disabled because it is a service account.
   • BThe server likely performs automated backups using the `svc_backup` service account, and the account is currently active.
   • CThe server is a domain controller because it has scheduled tasks.
   • DThe server is compromised because a service account is logged on interactively.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is identifying installed applications important in server profiling?

   • AIt helps determine the server's purpose and potential vulnerabilities.
   • BIt reveals the server's physical location.
   • CIt displays the server's CPU usage.
   • DIt shows the server's current network connections.
   Reveal Solution Discussion Select an answer first