Security Engineer noticed that a new strain of malware packs the file to increase its size to avoid being sandboxed. A forensic script is required to be uploaded to an endpoint remotely to flag…

Question

Options

• Asudo find / -type f -size +508494291c
• Bsudo find / -size +508494291c
• Csudo find / -type f -size +508494291c -name ""
• Dsudo find /* -type f -size +508494291c

• A
  88% (21)
• B
  4% (1)
• C
  8% (2)

Explanation

Option A (sudo find / -type f -size +508494291c) is correct because it combines all necessary elements: searching from the root /, restricting results to regular files with -type f, and filtering by size greater than 508,494,291 bytes using the c (character/byte) suffix with + meaning "greater than."

Why the distractors fail:

• B omits -type f, so it will also match directories, symlinks, and other non-file objects - producing false positives and making the forensic output unreliable.
• C adds -name "" which matches files with an empty name - an impossible condition on any real filesystem, so it returns zero results.
• D uses find /* instead of find /, which expands the glob in the shell before find runs; this misses files in the root directory itself and can cause "Argument list too long" errors on busy systems.

Memory tip: Think of find flags as a checklist - Where (/), What kind (-type f), How big (-size +Nc). If any piece is missing or broken, the command either finds too much, too little, or nothing at all.

No community discussion yet for this question.