Exam CS0-001 All Questions

View all questions & answers for the CS0-001 exam

Exam CS0-001 topic 1 question 71 discussion

Actual exam question from CompTIA's CS0-001

Question #: 71
Topic #: 1

A security analyst is performing a forensic analysis on a machine that was the subject of some historic SIEM alerts. The analyst noticed some network connections utilizing SSL on non-common ports, copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. Which of the following threats has the security analyst uncovered?

A. DDoS
B. APT
C. Ransomware
D. Software vulnerability

Show Suggested Answer

Suggested Answer: B 🗳️

by Samus_7 at Aug. 7, 2019, 10:29 a.m.

Comments

Submit Cancel

slcc99

Highly Voted 5 years, 1 month ago

This question was in the exam :)

upvoted 8 times

...

moe1985

Highly Voted 5 years, 3 months ago

B. APT right answer

upvoted 6 times

...

Jeend

Most Recent 2 years, 4 months ago

Control and Command -copies of svchost.exe and cmd.exe in %TEMP% folder, and RDP files that had connected to external IPs. APT

upvoted 1 times

...

Acrisius

4 years, 5 months ago

Answer B - APT. Similar Q on 002

upvoted 2 times

...

maps7

5 years ago

APT is the answer.

upvoted 1 times

...

cyber_now

5 years, 2 months ago

Those are all software vulnerabilities, however especially "RDP files that had connected to external IPs" definitely shows that APT involved and this is an attack.

upvoted 1 times

...

T_rev93

5 years, 2 months ago

APTs are usually the right answer when an exam has them as an option.

upvoted 1 times

...

s3curity

5 years, 5 months ago

yeah Its B

upvoted 4 times

...

Samus_7

5 years, 9 months ago

B. APT should not be that Advanced guys doing such tricks > ? not sure about SW issue.

upvoted 5 times

...

Exam CS0-001 All Questions

View all questions & answers for the CS0-001 exam

Exam CS0-001 topic 1 question 71 discussion

Comments

slcc99

moe1985

Jeend

Acrisius

maps7

cyber_now

T_rev93

s3curity

Samus_7

SY0-701