CS0-003: CompTIA Cybersecurity Analyst (CySA+)

By CompTIA · Question Mode

QuestionQ42

Incident Response and Management

Based on recent alerts, a security analyst believes that a web application server may have been compromised. The analyst examines the following server output:

Question Image

Which of the following best describes what has happened?

Explanation

An interactive login for the www web-service account is shown from a remote IP address on tty2. A web-service account would not normally require an interactive remote session, so this indicates an initiated unauthorized session.

Community Discussion

No comments yet. Be the first to start the discussion!