exam questions

Exam CS0-002 All Questions

View all questions & answers for the CS0-002 exam

Exam CS0-002 topic 1 question 320 discussion

Actual exam question from CompTIA's CS0-002
Question #: 320
Topic #: 1
[All CS0-002 Questions]

A security analyst is investigating a compromised Linux server. The analyst issues the ps command and receives the following output:



Which of the following commands should the administrator run NEXT to further analyze the compromised system?

  • A. strace /proc/1301
  • B. rpm -V openssh-server
  • C. /bin/ls -1 /proc/1301/exe
  • D. kill -9 1301
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
gnnggnnggnng
Highly Voted 2 years, 2 months ago
Selected Answer: C
C. /bin/ls -1 /proc/1301/exe. This command will show the absolute path to the executed binary file associated with the process ID 1301, which is ./usr/sbin/sshd. This information can help the security analyst determine if the binary is an official version and has not been modified, which could be an indicator of a compromise.
upvoted 13 times
2Fish
2 years, 1 month ago
Agree. Also, the given answer does not look to have the correct syntax. strace should be used with the -p (to define the process number.) So I think it would look like strace -p 1301
upvoted 3 times
...
[Removed]
1 year, 10 months ago
This person only puts answers from ChatGPT -- I literally put this question in ChatGPT 4.0 and it gave me a different answer. Although C is correct imo, I wouldn't just trust this guys answers.
upvoted 2 times
...
...
Stiobhan
Highly Voted 2 years, 2 months ago
Selected Answer: A
Think I am going to stick with given answer. I am not a Linux expert but this has given me enough info to make a good educated guess - https://man7.org/linux/man-pages/man1/strace.1.html
upvoted 6 times
...
rmwilsn
Most Recent 2 years ago
uh... C is not a command and will not provide any more information. A is the correct answer.
upvoted 1 times
Jacobmy98
2 years ago
i just used C in my linux machine. it works
upvoted 2 times
...
...
OnA_Mule
2 years, 1 month ago
Selected Answer: C
A. would be the correct answer if it has the -p flag, which is needed for the command syntax. B. Doesn't give us any additional info D. Terminates any connections, but won't give any additional insight. So C. has to be the answer.
upvoted 1 times
...
Kashim
2 years, 1 month ago
Selected Answer: A
The strace command is used to trace the system calls and signals of a running process, which can help a security analyst identify the root cause of a compromise. Going with A
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago