Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.

Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.

Exam 312-49v10 topic 1 question 45 discussion

Actual exam question from ECCouncil's 312-49v10
Question #: 45
Topic #: 1
[All 312-49v10 Questions]

If you see the files Zer0.tar.gz and copy.tar.gz on a Linux system while doing an investigation, what can you conclude?

  • A. The system files have been copied by a remote attacker
  • B. The system administrator has created an incremental backup
  • C. The system has been compromised using a t0rnrootkit
  • D. Nothing in particular as these can be operational files
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
torabi123
5 months, 3 weeks ago
This question is a nightmare: In a forensic investigation, it's crucial to be cautious and avoid making assumptions solely based on filenames. File analysis, metadata examination, and additional context are essential to make accurate conclusions and determine whether these files are benign, suspicious, or malicious.
upvoted 1 times
...
Famous_Guy
1 year, 2 months ago
Selected Answer: D
D: It's difficult to draw a conclusion based solely on the presence of files named Zer0.tar.gz and copy.tar.gz on a Linux system. These files could contain any number of things and their contents might be benign or malicious. To determine the nature of these files and what they contain, an investigation would have to be performed to examine their contents, metadata, and any other relevant information.
upvoted 3 times
...
sampb
1 year, 11 months ago
Selected Answer: C
C. seems more logical
upvoted 1 times
...
K3nz0420
2 years, 1 month ago
C sys compromised using t0rnrootkit
upvoted 1 times
...
K3nz0420
2 years, 1 month ago
C is the correct answer
upvoted 1 times
...
ctaregistro
2 years, 4 months ago
C. The system has been compromised using a t0rnrootkit https://pc-freak.net/tutorials/hacking_info/writeup.txt
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...