100-160 Question 119
Select 3A cybersecurity technician notices unusual activity on a Windows server. There are unauthorized file modifications, and an unknown process is running with elevated privileges. The technician suspects privilege escalation. Which action should the technician take to investigate and mitigate the issue?
- A
Use PowerShell to inspect running processes and identify the unknown process.
- B
Review the file and directory permissions on the server to check for misconfigurations.
- C
Disable Windows Defender temporarily to prevent interference during investigation.
- D
Check the system's Security Event Log for login events and privilege escalation attempts.
- E
Enable all inbound traffic on the host-based firewall to collect more network data.
Show answer and explanation
Correct answers: A, B, D
Explanation
Privilege escalation often involves exploiting misconfigurations or vulnerabilities to gain unauthorized access. Investigating processes, reviewing permissions, and checking event logs help identify the root cause and prevent recurrence. Disabling security features or exposing the system further is counterproductive and increases risk.
- A. Correct.
Using PowerShell to inspect running processes can help identify the unknown process and determine if it is malicious.
- B. Correct.
Reviewing file and directory permissions can reveal misconfigurations that might have allowed unauthorized access or privilege escalation.
- C. Incorrect.
Disabling Windows Defender temporarily is not recommended as it would leave the system vulnerable to further threats.
- D. Correct.
Checking the Security Event Log provides critical information about login attempts, privilege escalation, and other suspicious activity.
- E. Incorrect.
Enabling all inbound traffic on the host-based firewall would expose the system to additional risks and is not a recommended mitigation action.