Exam CS0-003 topic 1 question 333 discussion

Actual exam question from CompTIA's CS0-003

Question #: 333
Topic #: 1

SIMULATION
-

An organization has noticed large amounts of data are being sent out of its network. An analyst is identifying the cause of the data exfiltration.

INSTRUCTIONS
-

Select the command that generated the output in tabs 1 and 2.

Review the output text in all tabs and identify the file responsible for the malicious behavior.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Show Suggested Answer

Suggested Answer:

by Popeyes_Chicken at Jan. 27, 2025, 4:56 a.m.

Comments

Submit Cancel

Popeyes_Chicken

1 month, 2 weeks ago

In my opinion, all correct except the file being used for malicious behavior. The sftp.exe file hash matches, but legitimate programs can also be abused / used to live off the land. Multiple connections are also being established to different public addresses. cmd.exe looks to be a red herring, I'm leaning toward sftp.exe. Thoughts?

upvoted 2 times

JunkyJunk

1 week, 4 days ago

definitely see the data exfiltration for sftp and then there's cmd.exe's discrepancies between hashes. This is a CompTIA question...both answers might be correct but not entirely straightforward.

upvoted 1 times

...

fab34

3 weeks, 5 days ago

cmd.exe has a memory usage of 18.020 kbits thats why i would go with the cmd.exe

upvoted 1 times

...

Exam CS0-003 All Questions

View all questions & answers for the CS0-003 exam

Exam CS0-003 topic 1 question 333 discussion

Comments

Popeyes_Chicken

JunkyJunk

fab34

SY0-701