5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a server profiling exercise, an analyst runs 'netstat -ano' and sees that port 445 is listening. The analyst also checks logged-in users and finds that the 'Administrator' account is logged in from an unknown IP address. What should the analyst do next?

   • AInvestigate the source IP and the session's activity to determine if it is legitimate.
   • BDisconnect the Administrator session and block the IP address.
   • CAssume the Administrator account is compromised and reset the password immediately.
   • DIgnore the session because port 445 is a standard Windows port.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a server profiling engagement, an analyst runs `who` and sees an interactive session for user `svc_oracle` from a remote IP. The analyst also runs `ps aux` and observes a process running as `oracle` that is listening on port 1521. What should the analyst record as the most significant finding?

   • AThe `svc_oracle` account is a normal user account that should be disabled immediately.
   • BA service account is actively logged in from a remote host and is associated with the Oracle database process.
   • CThe remote IP is malicious because it is connected to a database port.
   • DThe Oracle database is exposed to the internet because port 1521 is listening.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is profiling a Windows server that is part of a critical application cluster. The analyst finds a scheduled task that runs a PowerShell script as SYSTEM every 15 minutes. The script is located in a world-writable directory. The analyst also sees that the script has been modified recently. What should the analyst recommend as the highest priority?

   • AMonitor the script for changes and alert if it is modified again.
   • BChange the scheduled task to run as a less privileged user.
   • CMove the script to a protected directory and restrict write permissions to administrators only.
   • DDisable the scheduled task immediately to prevent any malicious activity.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   During a server profiling, an analyst discovers that a service account `svc_app` is logged in from a remote IP address that is not in the approved list. The analyst also sees that the service account is running a process that is listening on a non-standard port. What is the most appropriate initial action?

   • ADocument the finding and correlate the remote IP with the process and listening port to determine if it is a legitimate new connection.
   • BChange the service account password to prevent further access.
   • CDisconnect the service account session immediately to prevent potential unauthorized access.
   • DIgnore the finding because service accounts often connect from various IPs.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is profiling a server that runs a custom application. The server has the following listening ports: - Port 8080 (HTTP) - Port 8443 (HTTPS) - Port 9999 (unknown) - Port 22 (SSH) The process on port 9999 is named 'java'. The server has Java installed, and the custom application is known to use Java. What is the most likely explanation for port 9999?

   • APort 9999 is a standard port for Java RMI, which is a security risk.
   • BThe custom application is using port 9999 for a secondary service, such as a management interface.
   • CPort 9999 is used by the Java debugger, which should be disabled in production.
   • DThe process on port 9999 is a malicious Java-based backdoor.
   Reveal Solution Discussion Select an answer first