Exam SY0-501 topic 1 question 929 discussion

Actual exam question from CompTIA's SY0-501

Question #: 929
Topic #: 1

While checking logs, a security engineer notices a number of end users suddenly downloading files with the .tar.gz extension. Closer examination of the files reveals they are PE32 files. The end users state they did not initiate any of the downloads. Further investigation reveals the end users all clicked on an external email containing an infected MHT file with an href link a week prior. Which of the following is MOST likely occurring?

A. A RAT was installed and is transferring additional exploit tools.
B. The workstations are beaconing to a command-and-control server.
C. A logic bomb was executed and is responsible for the data transfers.
D. A fireless virus is spreading in the local network environment.

Show Suggested Answer

Suggested Answer: A 🗳️

by exiledwl at Dec. 27, 2020, 2:53 a.m.

Comments

Submit Cancel

exiledwl

Highly Voted 4 years, 5 months ago

A RAT can take control of keyboard/mouse and download and launch executables https://www.makeuseof.com/tag/simply-effectively-deal-remote-access-trojans/#:~:text=Remote%20Access%20Trojans%20are%20nasty,from%20anywhere%20in%20the%20world.&text=A%20RAT%20Trojan%20can%20allow,of%20your%20keyboard%20and%20mouse.

upvoted 5 times

...

ID77

Most Recent 1 year, 3 months ago

Selected Answer: A

A growing trend is for attackers to deliver Trojan as Portable Executable (PE) files in 32 bit and 64 bit formats. They often compares the PE files using compression tools such as tar. Tar files have the tar.gz file extension.

upvoted 1 times

...