Câu 108: GCIH: GIAC Certified Incident Handler

Which of the following is a suspicious entry in the Volatility output attached?

1. A. Invalid IP address of the second Svchost connection
2. B. Incorrect owner for the UDP listening port for PID 900
3. C. Unusual port used for the TCP connection for PID 3872
4. D. Closed connection to a web server with no owner process — đáp án hiện tại