An incident response team member is triaging a Linux server. The output is shown below: Which of the following is the adversary most likely trying to do?

The correct answer is B. Execute commands through an unsecured service account. The log output indicates an attempt to execute a command via an unsecured service account, specifically using a wget command to download a file from an external source. This suggests that the adversary is trying to exploit a vulnerability in the web server to run unauthorized…

Submitted by mateo_ar· Mar 6, 2026Incident Response and Management

Question

An incident response team member is triaging a Linux server. The output is shown below:

Which of the following is the adversary most likely trying to do?

Exhibit

Options

ACreate a backdoor root account named zsh.
BExecute commands through an unsecured service account.
CSend a beacon to a command-and-control server.
DPerform a denial-of-service attack on the web server.

How the community answered

(23 responses)

A
9% (2)
B
70% (16)
C
17% (4)
D
4% (1)

Explanation

The log output indicates an attempt to execute a command via an unsecured service account, specifically using a wget command to download a file from an external source. This suggests that the adversary is trying to exploit a vulnerability in the web server to run unauthorized commands, which is a common technique for gaining a foothold or further compromising the system. The execute a malicious payload.

Topics

#Linux forensics#Adversary tactics#Service account compromise#Incident analysis

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice