Exam CS0-002 topic 1 question 321 discussion

Actual exam question from CompTIA's CS0-002

Question #: 321
Topic #: 1

HOTSPOT
-

Malware is suspected on a server in the environment.

The analyst is provided with the output of commands from servers in the environment and needs to review all output files in order to determine which process running on one of the servers may be malware.

INSTRUCTIONS
-

Servers 1, 2, and 4 are clickable. Select the Server and the process that host the malware.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Show Suggested Answer

Suggested Answer:

by engindn at Feb. 22, 2023, 3:30 p.m.

Comments

Submit Cancel

Starburst

Highly Voted 1 year, 10 months ago

This question and #14 are duplicates. #14 has the proper exhibits where 321 does not. The conclusion from both discussions is that Server4 and Svchost.exe are correct.

upvoted 6 times

...

[Removed]

Most Recent 2 years ago

1.) SERVER 1 2.) Notepad This was from the previous question.

upvoted 3 times

SpeedyG

1 year, 6 months ago

Correct me if I'm wrong, but in the actual PBQ the Svchost.exe associated with Server 4 looked most suspicious, so I don't think it's server 1 or notepad.

upvoted 3 times

...