The company's IDS has reported an anomaly. The cloud engineer remotely accesses the cloud instance, runs a command, and receives the following information: Which of the following is the most likely…

The correct answer is A. Privilege escalation. The output from the 'ps' command indicates there is a process running under the UID (User ID) of 0, which is the root user, and the command that was run is '/var/www/command.py'. Given that the normal Apache processes are running under their own UID (65535), this suggests that…

Security

Question

The company's IDS has reported an anomaly. The cloud engineer remotely accesses the cloud instance, runs a command, and receives the following information:

Which of the following is the most likely root cause of this anomaly?

Exhibit

Options

APrivilege escalation
BLeaked credentials
CCryptojacking
DDefaced website

How the community answered

(22 responses)

A
77% (17)
B
14% (3)
C
5% (1)
D
5% (1)

Explanation

The output from the 'ps' command indicates there is a process running under the UID (User ID) of 0, which is the root user, and the command that was run is '/var/www/command.py'. Given that the normal Apache processes are running under their own UID (65535), this suggests that a command was executed with root privileges that typically should not have such high-level access. This is a strong indicator of privilege escalation, where an unauthorized user or process gains elevated access to resources that are normally protected from an application or user.

Topics

#Cloud Security#Incident Response#Privilege Escalation#Anomaly Detection

Community Discussion

No community discussion yet for this question.

Full CV0-004 Practice