A systems administrator is reviewing the following information from a compromised server: Given the above information, which of the following processes was MOST likely exploited via a remote buffer overflow attack?
Data Execution Prevention can prevent buffer overflow attacks so that rules out B and D. C only has a connection with the loopback address (127.0.0.1) So that only leave answer A.
DEP=DataExecutionPrevention...so only possible answers is HTTPd(apache) and SQL...eliminate SQL because it is butt dialing itself! Loopback Addy....APACHE FINAL ANSWER!
DEP being enabled can prevent a buffer overflow but does not eliminate them entirely. I would think the answer would be D as the local address is set to a public IP of 191.168.1.10 which is not normal. Although I'm not entirely certain on this. Perhaps someone could shed some light on why this would have a public local address?
I'm not sure what command this came from but the format is related to some sort of routing table and specific to the process. the 0.0.0.0 Local addresses are default routes for those two processes LSASS/APACHE. 127.0.0.1 (loopback/localhost) routes only to itself. Then whatever interface 192.168.1.10 is tied to, routes outside to a remote address of 10.34.221.96. Totally valid to route a single ip to a destination. My take here is the keyword "buffer overflow". Googling DEP (Data Execution Prevention)(damage from viruses/threats), the two that are "no" are Apache and SQL. The MySql only routes to itself (localhost 127.0.0.1) so that is not it. It only leaves Apache.
Is it A LSASS because of the local address being 0.0.0.0 ?
upvoted 1 times
...
This section is not available anymore. Please use the main Exam Page.SY0-501 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Stefanvangent
Highly Voted 5 years, 9 months agockr8
Highly Voted 4 years, 11 months agodieglhix
4 years, 8 months agowho__cares123456789___
Most Recent 4 years, 5 months agoThePudding
4 years agoleesuh
4 years, 11 months agoBrickell305
4 years, 11 months agoArduwyn
5 years, 7 months agoArduwyn
5 years, 7 months agoredondo310
5 years, 6 months agoBasem
5 years, 10 months agoBasem
5 years, 10 months ago