Câu 107: CAS-004: CompTIA Advanced Security Practitioner (CASP+) CAS-004

SIMULATION -You are about to enter the virtual environment. Once you have completed the item in the virtual environment, you will NOT be allowed to return to this item. Click Next to continue. Question and Instructions -DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring.1. Disabling ssh2. Disabling systemd3. Altering the network adapter 172.162.0.04. Changing the password in the lab admin accountOnce you have completed the item in the virtual environment. you will NOT be allowed to return to this item. TEST QUESTION -This system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration. Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service. Examples of commands to use:kill, killalllsofman, --help (use for assistance)netstat (useful flags: a, n, g, u)ps (useful flag: a)systemctl (to control systemd)Please note: the list of commands shown above is not exhaustive. All native commands are available. INSTRUSTIONS -Using the following credentials:Username: labXXXadmin -Password: XXXyyYzz!Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes:1. End the compromised process that is using a malicious TCP service.2. Remove the malicious persistence agent by disabling the service's ability to start on boot.

1. A. Use sudo before any command the password is the same password provided, everything in <> is not part of the command is variable. Sudo will show you every detail you need. First command $sudo netstat -nltp, this will show you ip, port, pid, name of task. For added value you can also run $sudo lsof -i : . Now you need to find the service so you use $sudo systemctl --type=service | grep , this will give you .service my was -resolve.service forgot the full name. Suggest you do a $sudo systemctl status to compare. After all that lets kill it all, First kill the pid $sudo kill -9 . Then lets complete the second part $sudo systemctl stop , follow by $sudo systemctl disable . Now for the cream on the top you verify that is gone $sudo netstat -nltp and $sudo systemctl status . — đáp án hiện tại