Question 225 of 270 from exam CAS-003: CompTIA CASP+

Prev Question Next Question

Question

While investigating suspicious activity on a server, a security administrator runs the following report:

File system integrity check report
Total number of files: 3321
Added files: 12
Removed files

Changed files: 1

Change files:
changed: /etc/passwd

Detailed information about changes:
File: /etc/passwd
Perm: -rw-r--r-~ , ~rw-r-—xw-

Hash: md5:abeeSach928dfac3Sde2aczhef:

cae, mdS :def9a24cdbésdeafacbi Sacfed93eedb

In addition, the administrator notices changes to the /etc/shadow file that were not listed in the report.

Which of the following BEST describe this scenario? (Choose two.)

Answers

A. An attacker compromised the server and may have used a collision hash in the MD5 algorithm to hide the changes to the /etc/shadow file

B. An attacker compromised the server and may have also compromised the file integrity database to hide the changes to the /etc/shadow file

C. An attacker compromised the server and may have installed a rootkit to always generate valid MD5 hashes to hide the changes to the /etc/shadow file

D. An attacker compromised the server and may have used MD5 collision hashes to generate valid passwords, allowing further access to administrator accounts on the server

E. An attacker compromised the server and may have used SELinux mandatory access controls to hide the changes to the /etc/shadow file.

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D. E.

AB.

Prev Question Next Question