5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which command would a security analyst use to list installed applications on a Debian-based Linux server?

   • Ayum list installed
   • Bdpkg -l
   • Cpacman -Q
   • Drpm -qa
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of a scheduled task on a Windows server?

   • AA Task Scheduler entry
   • BA systemd service
   • CA cron job
   • DA launchd job
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst is profiling a server that was recently reinstalled. The server has the following characteristics: - The application 'TeamViewer' is installed, but the process is not running. - The server is listening on port 5938. - The process listening on port 5938 is named 'svchost.exe'. - The server has no other remote access tools installed. What is the most likely explanation?

   • ATeamViewer is running as a service under the name 'svchost.exe'.
   • BPort 5938 is used by a legitimate Windows service, and TeamViewer is not involved.
   • CThe server is running a honeypot on port 5938 to detect unauthorized remote access.
   • DTeamViewer is installed but not running, and port 5938 is used by a malicious process masquerading as svchost.exe.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An analyst is profiling a server that runs a custom application. The analyst sees that the application is listening on port 4444, and the process name is `nc` (netcat). The analyst also sees that the application is installed in `/tmp/`. What is the most likely conclusion?

   • AThe server is running a database because port 4444 is a database port.
   • BThe server is running a firewall because netcat is a network tool.
   • CThe server may be compromised, as netcat listening on a non-standard port from /tmp is a common backdoor indicator.
   • DThe server is running a legitimate custom application that uses netcat for communication.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is profiling a Linux server and notices that a process named `bash` is running as `www-data` and is connected to an external IP on port 443. The analyst also sees a scheduled task that runs a script that downloads a file from the same external IP. What should the analyst conclude?

   • AThe server is a web server that is being scanned by an external IP.
   • BThe server is running a legitimate web application that uses bash for CGI scripts.
   • CThe server is likely compromised, with a reverse shell and a persistence mechanism via the scheduled task.
   • DThe server is performing a legitimate software update.
   Reveal Solution Discussion Select an answer first