Exam CS0-001 topic 1 question 183 discussion

Actual exam question from CompTIA's CS0-001

Question #: 183
Topic #: 1

During the forensic a phase of a security investigation, it was discovered that an attacker was able to find private keys on a poorly secured team shared drive. The attacker used those keys to intercept and decrypt sensitive traffic on a web server. Which of the following describes this type of exploit and the potential remediation?

A. Session hijacking; network intrusion detection sensors
B. Cross-site scripting; increased encryption key sizes
C. Man-in-the-middle; well-controlled storage of private keys
D. Rootkit; controlled storage of public keys

Show Suggested Answer

Suggested Answer: C 🗳️

by lupinart at May 10, 2020, 9:34 p.m.

Comments

Submit Cancel

Jeend

2 years, 3 months ago

discovered that an attacker was able to find private keys on a poorly secured team shared drive Is MITM

upvoted 1 times

...

lupinart

4 years, 11 months ago

Wouldnt this be a rootkit since the attacker has access to the shared drive poss on a workstation?

upvoted 1 times

s3curity1

4 years, 11 months ago

C is a better answer since the traffic was intercepted, so it already became MITM when the traffic was interecepted. The private keys found on the shared drive allowed the traffic to be decrypted - so potential remediation would be well-controlled storage of private keys. We also can't definitely say that this is a rootkit since we don't know how the attacker accessed the workstation - there could be lots of methods, and without concrete information from the question itself, we can't say that the attacker used a rootkit.

upvoted 5 times

...

Exam CS0-001 All Questions

View all questions & answers for the CS0-001 exam

Exam CS0-001 topic 1 question 183 discussion

Comments

Jeend

lupinart

s3curity1

SY0-701