While Investigating Suspicious Activity on a Server, a Security Administrator

question 348

Multiple Choice

While investigating suspicious activity on a server, a security administrator runs the following report: In addition, the administrator notices changes to the /etc/shadow file that were not listed in the report. Which of the following BEST describe this scenario? (Choose two.)

• A) An attacker compromised the server and may have used a collision hash in the MD5 algorithm to hide the changes to the /etc/shadow file
• B) An attacker compromised the server and may have also compromised the file integrity database to hide the changes to the /etc/shadow file
• C) An attacker compromised the server and may have installed a rootkit to always generate valid MD5 hashes to hide the changes to the /etc/shadow file
• D) An attacker compromised the server and may have used MD5 collision hashes to generate valid passwords, allowing further access to administrator accounts on the server
• E) An attacker compromised the server and may have used SELinux mandatory access controls to hide the changes to the /etc/shadow file

---

Definitions:

Error Variance

The variability in a set of data that cannot be attributed to the factors being studied, often resulting from measurement errors or other inconsistencies.

Dependent Sample Designs

Research designs involving comparisons of measurements from the same group of subjects under different conditions or at different times.

Extraneous Variables

Factors in a study that could undermine the internal validity by influencing the dependent variable in a way not intended by the research.

Independent Variables

Variables in an experiment that are manipulated or changed by the researcher to observe their effect on dependent variables.