Chapter 3: Malicious Activity

Which of the following Linux commands will show you how much disk space is in use?

• 1. top

• 1. df

• 1. lsof

• 1. ps

Answer explanation

The df command will show you a system's current disk utilization. Both the top command and the ps command will show you information about processes, CPU, and memory utilization, whereas lsof is a multifunction tool for listing open files.

What Windows tool provides detailed information, including information about USB host controllers, memory usage, and disk transfers?

• 1. Statmon

• 1. Resmon

• 1. Perfmon

• 1. Winmon

Answer explanation

Perfmon, or Performance Monitor, provides the ability to gather detailed usage statistics for many items in Windows. Resmon, or Resource Monitor, monitors CPU, memory, and disk usage but does not provide information about things like USB host controllers and other detailed instrumentation. Statmon and winmon are not Windows built-in tools.

What type of network information should you capture to be able to provide a report about how much traffic systems in your network sent to remote systems?

• 1. Syslog data

• 1. WMI data

• 1. Resmon data

• 1. Flow data

Answer explanation

Flow data provides information about the source and destination IP address, protocol, and total data sent and would provide the detail needed. Syslog, WMI, and resmon data are all system log information and would not provide this information.

Which of the following technologies is best suited to prevent wired rogue devices from connecting to a network?

• 1. NAC

• 1. PRTG

• 1. Port security

• 1. NTP

Answer explanation

Network access control (NAC) can be set up to require authentication. Port security is limited to recognizing MAC addresses, making it less suited to preventing rogue devices. PRTG is a monitoring tool, and NTP is the Network Time Protocol.

As part of her job, Danielle sets an alarm to notify her team via email if her Windows server uses 80 percent of its memory and to send a text message if it reaches 90 percent utilization. What is this setting called?

• 1. A monitoring threshold

• 1. A preset notification level

• 1. Page monitoring

• 1. Perfmon calibration

Answer explanation

A monitoring threshold is set to determine when an alarm or report action is taken. Thresholds are often set to specific values or percentages of capacity.

Chris is reviewing a file that is part of an exploit package. He notes that there is a file that has content with curly brackets ({}) around statements. What file type from the following list he most likely reviewing?

• 1. Plain text

• 1. JSON

• 1. XML

• 1. HTML

Answer explanation

Chris is most likely reviewing a JSON file. HTML and XML typically use angle brackets (< and >) rather than curly brackets. Plain text does not use or require either.

What term describes a system sending heartbeat traffic to a botnet command-and-control server?

• 1. Beaconing

• 1. Zombie ping

• 1. CNCstatus

• 1. CNClog

Answer explanation

Beaconing activity (sometimes called heartbeat traffic) occurs when traffic is sent to a botnet command-and-control system. The other terms are made up.

Cameron wants to check if a file matches a known-good original. What technique can he use to do so?

• 1. Decrypt both the file and the original to compare them.

• 1. Use strings to compare the file content.

• 1. Hash both the file and the original and compare the hashes.

• 1. Check the file size and creation date.

Answer explanation

Cameron should compare the hashes of the known-good original and the new file to see if they match. The files are not described as encrypted, so decrypting them won't help. Strings can show text in binary files but won't compare the files. File size and creation date are not guarantees of a file being the same.

What can the MAC address of a rogue device tell you?

• 1. Its operating system version

• 1. The TTL of the device

• 1. What type of rogue it is

• 1. The manufacturer of the device

Answer explanation

Hardware vendor ID codes are part of MAC addresses and can be checked for devices that have not had their MAC address changed. It is possible to change MAC addresses, so relying on only the MAC address is not recommended, but it can be useful to help identify what a rogue device might be.

How can Jim most effectively locate a wireless rogue access point that is causing complaints from employees in his building?

• 1. Nmap

• 1. Signal strength and triangulation

• 1. Connecting to the rogue AP

• 1. NAC

Answer explanation

Locating a rogue AP is often best done by performing a physical survey and triangulating the likely location of the device by checking its signal strength. If the AP is plugged into the organization's network, nmap may be able to find it, but connecting to it is unlikely to provide its location (or be safe!). NAC would help prevent the rogue device from connecting to an organizational network but won't help locate it.