5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is profiling a server that runs a critical financial application. The server has a scheduled task that runs a data export every hour using the 'svc_export' account. The analyst also sees that 'svc_export' is logged in interactively from a remote IP address that is not in the company's known range. The scheduled task is legitimate. What is the most appropriate action?

   • AChange the 'svc_export' account password and update the scheduled task.
   • BInvestigate the remote IP address and the session's activity to determine if it is authorized.
   • CDisable the scheduled task to prevent the export from running while the account is compromised.
   • DImmediately terminate the interactive session and block the remote IP address.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which command would a security analyst use to display a snapshot of all currently running processes on a Linux server?

   • Awho -a
   • Bls -la
   • Cnetstat -an
   • Dps -ef
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An analyst is profiling a web server that hosts a public-facing application. The server has the following characteristics: - Process 'nginx' is running and listening on port 80. - Process 'php-fpm' is running and listening on port 9000. - Process 'mysql' is running and listening on port 3306. - The server has a firewall that only allows inbound traffic on ports 80 and 443. What is the most significant security concern?

   • AThe nginx process is running as root, which could lead to privilege escalation.
   • BThe php-fpm service is listening on port 9000, which is a non-standard port.
   • CThe MySQL service is listening on a public interface, even though the firewall blocks external access.
   • DThe server has too many services running, which increases the attack surface.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is profiling a server that is suspected of running a database. The analyst runs `netstat -ano` and sees that port 5432 is listening. Which additional evidence would most strongly confirm that this is a PostgreSQL database server?

   • AThe server is running Windows Server 2019.
   • BPort 5432 is open in the firewall.
   • CA process named `postgres` is running and listening on port 5432.
   • DThe server has a static IP address.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is profiling a server that hosts a custom line-of-business application. The analyst uses `netstat -ano` and sees that port 443 is listening, and `tasklist` shows `httpd.exe` running. Which additional command would best help the analyst identify the specific application version and patch level?

   • ARun `netstat -ano` again to see more connections.
   • BRun `whoami` to confirm the user context of the process.
   • CRun `tasklist /svc` to see which services are hosted by httpd.exe.
   • DRun `wmic product get name,version` to list installed software and versions.
   Reveal Solution Discussion Select an answer first