200-201 Question 186
Select 4A cybersecurity analyst is investigating a potential malware infection on a Linux server. The analyst needs to examine the processes currently running on the machine, check the system logs for suspicious entries, and review the system’s network activity. Which operating system components should the analyst utilize to perform these tasks effectively?
- A
Kernel
- B
Syslog
- C
Task Manager
- D
Command-line interface (CLI)
- E
Network interfaces
Show answer and explanation
Correct answers: A, B, D, E
Explanation
In this scenario, the analyst needs to focus on tools and components specific to Linux that assist in process monitoring, log analysis, and network activity review. Syslog provides access to system logs, the CLI allows execution of necessary commands for process and network monitoring, and network interfaces are essential for understanding network activity. While the kernel is a vital OS component, it is not directly used for these investigative tasks, and Task Manager is a Windows feature, making it irrelevant to this scenario.
- A. Correct.
The kernel is the core of the operating system that manages hardware resources and system functions. While it is critical for the OS to function, it is not directly used by an analyst for tasks such as process review, log examination, or network activity monitoring.
- B. Correct.
Syslog is a critical component of Linux that manages system logs, which are invaluable for investigating suspicious activities or identifying malware behaviors.
- C. Incorrect.
Task Manager is a Windows-specific feature used for managing processes. Since the scenario involves a Linux server, Task Manager is irrelevant in this context.
- D. Correct.
The command-line interface (CLI) is a powerful tool in Linux that allows the analyst to execute commands like
psfor process monitoring,tailfor viewing logs, andnetstatorssfor checking network activity. - E. Correct.
Network interfaces are critical for monitoring and analyzing network activity on the Linux server. Tools like
ifconfigoripcommand can help the analyst assess the network configuration and connections.