A security analyst is responding to an incident that is related to an unauthorized communication between systems. While triaging the event, the analyst obtains the following outputs: Which of the…

The correct answer is D. kill -9 5996. PID 5996 is the Python reverse‑shell process that opened the TCP session to 10.203.10.22:1234. Terminating that parent process will sever the malicious connection and kill its child shell.

Submitted by alyssa_d· Mar 6, 2026Incident Response and Management

Question

A security analyst is responding to an incident that is related to an unauthorized communication between systems. While triaging the event, the analyst obtains the following outputs:

Which of the following commands should the analyst use to terminate the malicious session?

Exhibit

Options

Akill -9 4347
Ckill -9 701
Dkill -9 5996

How the community answered

(43 responses)

A
12% (5)
C
5% (2)
D
84% (36)

Explanation

PID 5996 is the Python reverse‑shell process that opened the TCP session to 10.203.10.22:1234. Terminating that parent process will sever the malicious connection and kill its child shell.

Topics

#process management#Linux commands#incident response#containment

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice