Exam SY0-701 topic 1 question 303 discussion

Actual exam question from CompTIA's SY0-701

Question #: 303
Topic #: 1

A company web server is initiating outbound traffic to a low-reputation, public IP on non-standard pat. The web server is used to present an unauthenticated page to clients who upload images the company. An analyst notices a suspicious process running on the server hat was not created by the company development team. Which of the following is the most likely explanation for his security incident?

A. A web shell has been deployed to the server through the page.
B. A vulnerability has been exploited to deploy a worm to the server.
C. Malicious insiders are using the server to mine cryptocurrency.
D. Attackers have deployed a rootkit Trojan to the server over an exposed RDP port.

Show Suggested Answer

Suggested Answer: A 🗳️

by a4e15bd at Aug. 14, 2024, 2:53 a.m.

Comments

Submit Cancel

a4e15bd

Highly Voted 4 months, 3 weeks ago

A. A web shell has been deployed to the server through the page. The shell would allow the attacker to gain unauthorized access and control over the server.

upvoted 6 times

...

Bamboo1

Most Recent 1 week ago

Selected Answer: A

This is so badly worded..

upvoted 4 times

...