Exam SPLK-5001 Topic 4 Question 27 Discussion

Actual exam question for Splunk's SPLK-5001 exam
Question #: 27
Topic #: 4

During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

A. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions. B. Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs. C. Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed. D. Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business