5.8 Identify These Elements Used for Server Profiling 200-201 Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A server profiling report shows a scheduled task that runs a binary from a temporary directory every 15 minutes. The task runs as 'SYSTEM'. The analyst also sees that the binary is not listed in the installed applications. What should the analyst do?

   • AAdd the binary to the antivirus exclusions to prevent false positives.
   • BDelete the scheduled task and the binary immediately.
   • CQuarantine the binary and analyze it in a sandbox to determine its purpose.
   • DChange the task to run under a less privileged account.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a server profiling, an analyst sees that a server is listening on port 22 and port 2222. The process associated with port 2222 is named 'sshd'. The analyst also sees that the server has OpenSSH installed. What should the analyst do?

   • ABlock port 2222 immediately to prevent unauthorized access.
   • BKill the process on port 2222 because it is not the standard SSH port.
   • CInvestigate the configuration of the process on port 2222 to determine if it is a legitimate second SSH service.
   • DAssume the second SSH daemon is a honeypot and ignore it.
   Reveal Solution Discussion Select an answer first