GIAC
GCIH · Question #837
An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?
Sign in or unlock GCIH to reveal the answer and full explanation for question #837. The question stem and answer options stay visible for context.
Incident Response & Cyber Kill Chain
Question
An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?
Exhibit
Options
- AThe kworker thread was exploited using process injection
- BThe SSH user account credentials have been compromised
- CAn attacker uploaded a malicious python library to a well-known repository
- DAn attacker accessed the system through a backdoor using netcat
Unlock GCIH to see the answer
You've previewed enough free GCIH questions. Unlock GCIH for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#SSH compromise#netcat backdoor#incident analysis#backdoor detection