100-160 Question 117
Select 2A system administrator notices unauthorized changes to a critical configuration file on a Linux server. They suspect privilege escalation was used to modify the file. Which TWO actions should they take to investigate and secure the system?
- A
Check the file's access logs to identify which user made the changes.
- B
Inspect the sudoers file to identify any unauthorized modifications.
- C
Disable Windows Defender to prevent interference with the investigation.
- D
Review active processes using the
pscommand for suspicious activity. - E
Use PowerShell to inspect privileges assigned to user accounts on the Linux system.
Show answer and explanation
Correct answers: A, B
Explanation
Privilege escalation often involves unauthorized changes to system files or configurations. To investigate, the administrator should check access logs to track user actions and inspect the sudoers file for unauthorized entries. These steps directly address the potential cause and help secure the system.
- A. Correct.
Checking the file's access logs can help determine which user or process made changes to the configuration file, which is essential for investigating privilege escalation.
- B. Correct.
Inspecting the sudoers file is a critical step because unauthorized modifications could allow attackers to escalate privileges on the system.
- C. Incorrect.
Disabling Windows Defender is irrelevant in this scenario as the system in question is a Linux server, not a Windows system.
- D. Incorrect.
While reviewing active processes (
pscommand) is useful for identifying suspicious activity, it does not directly address privilege escalation or unauthorized file changes. - E. Incorrect.
PowerShell is a Windows-specific tool and cannot be used to inspect privileges on a Linux system.