A security analyst is investigating a security breach. Upon inspection of the audit an access logs, the analyst notices the host was accessed and the /etc/passwd file was modified with a new entry…

A logic bomb is malicious code that executes when specific conditions are met; it does not align with the observed attack of creating a persistent privileged user account in /etc/passwd.

Adding a user with UID 0 to /etc/passwd is a classic backdoor technique, granting the attacker persistent root-level access to the system without needing to exploit a vulnerability again on subsequent logins.

A keylogger captures keystrokes to steal credentials but does not explain the creation of a new UID 0 account in /etc/passwd, making it an unlikely attack vector in this scenario.

Netstat displays active network connections, listening ports, and established sessions, allowing the analyst to identify any suspicious or unauthorized connections that indicate the attacker may still be connected or has left a listening service running.

Tracert (traceroute) maps the network path between hosts and is used for network path diagnostics, not for identifying active or ongoing unauthorized connections on a compromised host.

Ping tests basic ICMP reachability to a host and provides no information about active sessions, open ports, or whether an attacker is currently connected to the system.