QUESTION: 153

A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:

However, the analyst is unable to find any evidence of the running shell.
Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?

The NX bit is enabled
The system uses ASLR
The shell is obfuscated
The code uses dynamic libraries

Answer(s): C

Reveal Solution Next Question

QUESTION: 154

Ann, a terminated employee, left personal photos on a company-issued laptop and no longer has access to them. Ann emails her previous manager and asks to get her personal photos back.

Which of the following BEST describes how the manager should respond?

Determine if the data still exists by inspecting to ascertain if the laptop has already been wiped and if the storage team has recent backups.
Inform Ann that the laptop was for company data only and she should not have stored personal photos on a company asset.
Report the email because it may have been a spoofed request coming from an attacker who is trying to exfiltrate data from the company laptop.
Consult with the legal and/or human resources department and check company policies around employment and termination procedures.

Answer(s): D

Reveal Solution Next Question

QUESTION: 155

During the decommissioning phase of a hardware project, a security administrator is tasked with ensuring no sensitive data is released inadvertently. All paper records are scheduled to be shredded in a crosscut shredder, and the waste will be burned. The system drives and removable media have been removed prior to e-cycling the hardware.

Which of the following would ensure no data is recovered from the system drives once they are disposed of?

Overwriting all HDD blocks with an alternating series of data.
Physically disabling the HDDs by removing the drive head.
Demagnetizing the hard drive using a degausser.
Deleting the UEFI boot loaders from each HD

Answer(s): C

Reveal Solution Next Question

QUESTION: 156

A company has decided to lower costs by conducting an internal assessment on specific devices and various internal and external subnets. The assessment will be done during regular office hours, but it must not affect any production servers.

Which of the following would MOST likely be used to complete the assessment? (Choose two.)

Agent-based vulnerability scan
Black-box penetration testing
Configuration review
Social engineering
Malware sandboxing
Tabletop exercise

Answer(s): A,C

Reveal Solution Next Question

Free CAS-003 Exam Braindumps (page: 39)

QUESTION: 153

QUESTION: 154

QUESTION: 155

QUESTION: 156