While investigating an email server that crashed, an analyst reviews the following log files: Which of the following is most likely the root cause?

The correct answer is A. The administrator's account credentials were intercepted and reused. The log shows the backup-admin performing network access followed shortly by the SYSTEM user deleting mailbox data, indicating possible misuse of the administrator’s credentials or session. This suggests the administrator’s credentials were likely intercepted and reused…

Submitted by chen.hong· Mar 6, 2026Security Operations

Question

While investigating an email server that crashed, an analyst reviews the following log files:

Which of the following is most likely the root cause?

Exhibits

Options

AThe administrator's account credentials were intercepted and reused.
BThe backup process did not complete and caused cascading failure.
CA hardware failure in the storage array caused the mailboxes to be inaccessible.
DA user with low privileges was able to escalate and erase all mailboxes.

How the community answered

(38 responses)

A
79% (30)
B
11% (4)
C
3% (1)
D
8% (3)

Explanation

The log shows the backup-admin performing network access followed shortly by the SYSTEM user deleting mailbox data, indicating possible misuse of the administrator’s credentials or session. This suggests the administrator’s credentials were likely intercepted and reused, leading to unauthorized deletion and the server crash.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice