nerdexam
CompTIA

CAS-003 · Question #10

A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis: Which of the following does the log sample indicate?…

The correct answer is C. Jsmith successfully used a privilege escalation attack E. Buffer overflow in memory paging caused a kernel panic. The syslog entries show that jsmith escalated privileges to root, and a subsequent buffer overflow in kernel memory paging caused a kernel panic that forced the unexpected reboot.

Enterprise Security Operations

Question

A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis:

Which of the following does the log sample indicate? (Choose two.)

Exhibit

CAS-003 question #10 exhibit

Options

  • AA root user performed an injection attack via kernel module
  • BEncrypted payroll data was successfully decrypted by the attacker
  • CJsmith successfully used a privilege escalation attack
  • DPayroll data was exfiltrated to an attacker-controlled host
  • EBuffer overflow in memory paging caused a kernel panic
  • FSyslog entries were lost due to the host being rebooted

How the community answered

(64 responses)
  • A
    9% (6)
  • B
    5% (3)
  • C
    63% (40)
  • D
    2% (1)
  • F
    22% (14)

Why each option

The syslog entries show that jsmith escalated privileges to root, and a subsequent buffer overflow in kernel memory paging caused a kernel panic that forced the unexpected reboot.

AA root user performed an injection attack via kernel module

The log does not indicate a kernel module was loaded or that an injection attack was performed via that vector.

BEncrypted payroll data was successfully decrypted by the attacker

There is no indication in the described log entries that encrypted data was decrypted by an attacker.

CJsmith successfully used a privilege escalation attackCorrect

Syslog entries indicating a transition from a normal user (jsmith) to root-level access without a legitimate sudo or su command show a successful privilege escalation attack, which is consistent with a targeted insider or compromised account scenario.

DPayroll data was exfiltrated to an attacker-controlled host

The log entries do not show any outbound data transfer or exfiltration to an external host.

EBuffer overflow in memory paging caused a kernel panicCorrect

A kernel panic - which forces an immediate unplanned reboot - is a common result of a buffer overflow corrupting kernel memory structures such as those involved in memory paging, explaining the unexpected reboot reported by the administrator.

FSyslog entries were lost due to the host being rebooted

The syslog entries were successfully exported and provided for analysis, indicating they were not lost due to the reboot.

Concept tested: Interpreting syslog entries for privilege escalation and kernel panic

Source: https://www.kernel.org/doc/html/latest/admin-guide/bug-hunting.html

Topics

#log analysis#privilege escalation#buffer overflow#kernel panic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice