5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is profiling a server that runs a critical application. The server has a scheduled task that runs a maintenance script every Sunday at 3:00 AM using the 'svc_maint' account. The analyst also sees that the 'svc_maint' account is currently logged in interactively from a workstation in the IT department. The maintenance script is known to be legitimate. What is the most appropriate action?

   • ATerminate the interactive session and disable the 'svc_maint' account.
   • BIgnore the interactive session because the scheduled task is legitimate.
   • CChange the 'svc_maint' account password and update the scheduled task.
   • DInvestigate the interactive session to determine if it is authorized, and review the scheduled task's configuration.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is profiling a server and runs `ps aux` to see running processes. The analyst notices a process named `cron` that is running, and also sees a scheduled task in `/etc/cron.d/` that runs a script every 5 minutes. What should the analyst record in the profile?

   • AThe server has no active processes because cron is a background daemon.
   • BThe server has automated tasks scheduled via cron that run every 5 minutes.
   • CThe server is running a web server because cron is running.
   • DThe server is compromised because cron is running.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is identifying running processes important in server profiling?

   • AIt reveals which applications and services are currently executing.
   • BIt displays the server's hardware temperature.
   • CIt lists all user accounts on the system.
   • DIt shows the server's IP address and subnet mask.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a server profiling activity, an analyst runs 'w' and sees an interactive session from a user named 'backup' that the analyst does not recognize. The analyst also checks scheduled tasks and finds a task that runs a PowerShell script as 'backup' every hour. What is the most appropriate next step?

   • AAdd the 'backup' account to the local administrators group to ensure it has proper permissions.
   • BDisable the scheduled task immediately to stop the unknown activity.
   • CChange the 'backup' account password and log off the session.
   • DInvestigate the 'backup' account's recent logon events and the script's contents before taking action.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is profiling a Linux server and runs `lastlog` to see when accounts last logged in. The analyst notices that the `root` account has never logged in, but the `ansible` account logged in recently. What is the most reasonable conclusion?

   • AThe server is likely managed remotely via Ansible using the `ansible` account, and direct root logins are disabled or unused.
   • BThe server is not being used because no one logs in as root.
   • CThe server is compromised because root has never logged in.
   • DThe `ansible` account is malicious and should be removed.
   Reveal Solution Discussion Select an answer first