nerdexam
GIAC

GSNA · Question #12

John works as a Network Administrator for We-are-secure Inc. The We-are-secure server is based on Windows Server 2003. One day, while analyzing the network security, he receives an error message…

The correct answer is C. He should observe the process viewer (Task Manager) to see whether any new process is D. He should upgrade his antivirus program. In such a situation, when John receives an error message revealing that Kernel32.exe is encountering a problem, he needs to come to the conclusion that his antivirus program needs to be updated, because Kernel32.exe is not a Microsoft file (It is a Kernel32.DLL file.). Although…

Windows System Auditing

Question

John works as a Network Administrator for We-are-secure Inc. The We-are-secure server is based on Windows Server 2003. One day, while analyzing the network security, he receives an error message that Kernel32.exe is encountering a problem. Which of the following steps should John take as a countermeasure to this situation?

Options

  • AHe should download the latest patches for Windows Server 2003 from the Microsoft site, so that
  • BHe should restore his Windows settings.
  • CHe should observe the process viewer (Task Manager) to see whether any new process is
  • DHe should upgrade his antivirus program.

How the community answered

(34 responses)
  • A
    9% (3)
  • B
    21% (7)
  • C
    71% (24)

Explanation

In such a situation, when John receives an error message revealing that Kernel32.exe is encountering a problem, he needs to come to the conclusion that his antivirus program needs to be updated, because Kernel32.exe is not a Microsoft file (It is a Kernel32.DLL file.). Although such viruses normally run on stealth mode, he should examine the process viewer (Task Manager) to see whether any new process is running on the computer or not. If any new process (malicious) is running on the server, he should exterminate that process. Answer: A, B are incorrect. Since kernel.exe is not a real kernel file of Windows, there is no need to repair or download any patch for Windows Server 2003 from the Microsoft site to repair the

Topics

#malware detection#Windows process monitoring#Task Manager#kernel process spoofing

Community Discussion

No community discussion yet for this question.

Full GSNA Practice