nerdexam
EC-Council

EC0-350 · Question #744

After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p…

The correct answer is C. nobody, dns. See the full explanation below for the reasoning.

Question

After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 5. passwd nobody -d 6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 7. passwd dns -d 8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 9. touch -acmr /etc/X11/applnk/Internet/.etc /etc

Options

  • AIUSR_
  • Bacmr, dns
  • Cnobody, dns
  • Dnobody, IUSR_

How the community answered

(38 responses)
  • A
    8% (3)
  • B
    5% (2)
  • C
    84% (32)
  • D
    3% (1)

Community Discussion

No community discussion yet for this question.

Full EC0-350 Practice