100-160 Question 118
Select 4A system administrator notices abnormal behavior on a Windows server, such as unknown processes running and unauthorized changes to files. The administrator suspects privilege escalation by a malicious actor. Which of the following steps should the administrator prioritize to investigate and mitigate the issue?
- A
Check the Event Viewer logs for suspicious activities and unauthorized access attempts.
- B
Run a Windows Defender scan to detect and remove potential malware.
- C
Temporarily disable the host-based firewall to allow deeper analysis of network traffic.
- D
Inspect file and directory permissions to identify unauthorized modifications.
- E
Use PowerShell to list user accounts and verify their privilege levels.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To investigate and mitigate privilege escalation, the administrator must gather evidence and take appropriate steps to identify the root cause of the issue. Checking logs, running a malware scan, inspecting file permissions, and reviewing user accounts are critical steps in identifying the attack vector and mitigating the threat. However, disabling the host-based firewall would unnecessarily increase the system's vulnerability and is not recommended.
- A. Correct.
Event Viewer logs provide detailed information about system activities, including login attempts, privilege escalations, and suspicious events. This is an essential step in investigating the issue.
- B. Correct.
A Windows Defender scan can detect and remove malware that may be causing the abnormal behavior or attempting privilege escalation.
- C. Incorrect.
Disabling the host-based firewall is not advisable, as it would expose the system to further attacks. This action would not contribute to investigating privilege escalation effectively.
- D. Correct.
Inspecting file and directory permissions can reveal unauthorized changes that may indicate privilege escalation. It helps identify how the attacker gained access or elevated privileges.
- E. Correct.
Using PowerShell to list user accounts and verify their privilege levels can help identify any newly created or modified accounts with elevated privileges, which is a common sign of privilege escalation.