Exploitation & Mitigation GFACT Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A security analyst is investigating a compromised Linux server. The analyst finds that the 'mysql' user has write access to a systemd service file that runs as root. The attacker modified the service to execute a reverse shell. Which two concepts are demonstrated by this finding?

   • AReconnaissance and weaponization
   • BPrivilege escalation and persistence
   • CCredential harvesting and command and control
   • DDelivery and exploitation
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security analyst is reviewing a log of a successful attack. The log shows that the attacker sent a phishing email with a malicious link. The link led to a website that exploited a browser vulnerability and then downloaded and executed a remote access trojan. Which stages of the Cyber Kill Chain are present in this log?

   • AReconnaissance, Weaponization, Delivery, Command and Control
   • BDelivery, Exploitation, Installation, Actions on Objectives
   • CWeaponization, Delivery, Exploitation, Installation
   • DWeaponization, Delivery, Exploitation, Command and Control
   Reveal Solution Discussion Select an answer first