200-201 Question 382
Select 4While investigating a compromised server, you suspect a malicious process is running on the system. Which of the following steps would help you identify and confirm the malicious process?
- A
Check the process name and compare it with known trusted processes.
- B
Verify the process's parent-child relationship to identify unusual hierarchies.
- C
Immediately terminate any process consuming high CPU or memory resources.
- D
Examine the file path of the process to ensure it is running from a legitimate directory.
- E
Analyze the hash of the executable file associated with the process against a threat intelligence database.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Identifying a malicious process involves a systematic approach, including checking process names, verifying parent-child relationships, examining file paths, and analyzing file hashes. Blindly terminating processes without investigation can disrupt legitimate services and should be avoided.
- A. Correct.
Checking the process name can help identify if it matches known trusted processes. However, attackers may use names similar to legitimate processes, so this is only a first step.
- B. Correct.
Verifying the process's parent-child relationship can reveal unusual hierarchies, such as a legitimate process spawning a suspicious child process.
- C. Incorrect.
Immediately terminating a process based solely on resource usage can disrupt legitimate services and should not be done without further investigation.
- D. Correct.
Examining the file path helps verify if the process is running from a legitimate directory, as malicious processes often execute from unusual or unauthorized locations.
- E. Correct.
Analyzing the hash of the executable against a threat intelligence database allows you to confirm whether the file is associated with known malware.