While Investigating Suspicious Activity on a Server, a Security Administrator

question 348

Multiple Choice

While investigating suspicious activity on a server, a security administrator runs the following report: In addition, the administrator notices changes to the /etc/shadow file that were not listed in the report. Which of the following BEST describe this scenario? (Choose two.)

• A) An attacker compromised the server and may have used a collision hash in the MD5 algorithm to hide the changes to the /etc/shadow file
• B) An attacker compromised the server and may have also compromised the file integrity database to hide the changes to the /etc/shadow file
• C) An attacker compromised the server and may have installed a rootkit to always generate valid MD5 hashes to hide the changes to the /etc/shadow file
• D) An attacker compromised the server and may have used MD5 collision hashes to generate valid passwords, allowing further access to administrator accounts on the server
• E) An attacker compromised the server and may have used SELinux mandatory access controls to hide the changes to the /etc/shadow file

---

Definitions:

Punishment

A measure or consequence applied in response to undesired behavior, aiming to discourage such behavior in the future.

Delayed Reinforcement

A form of reinforcement in which a reward or outcome is given some time after the desired behavior is exhibited, potentially affecting the strength and speed of the learning process.

Discrepancy Reduction

The process of identifying and closing gaps between current states and desired states or goals.

Discrepancy Production

The generation of a difference or inconsistency between actual performances or outcomes and the expected or desired ones.