At a SaaS company, a command-line log shows one process encoding a payload and starting a child process that opens an outbound connection. What does that host log support?
Select an answer to reveal the explanation.
Short Explanation
A worker packing a sealed box and sending a runner out the door is suspicious movement, not a passport photo. You have a process encoding a payload and a child opening an outbound connection. The trap is treating that command line as a legal name, a certificate failure, or a router sampling rate.
Full Explanation
A command-line log of a process that encodes a payload and starts a child which then opens an outbound connection is evidence of suspicious process execution on that host. It supports a containment review of the parent, the child, and the connection. It does not identify a human by travel documents, and it is not a network-export setting. Suspicious process execution on this host that is serious enough to start a containment review is what the log supports. Proof of the actor passport name and legal identity, taken from the process path on this host alone, overclaims attribution; a process path does not establish a passport name. A failed certificate chain on the outbound connection, as documented by this command-line log entry, would be a TLS validation result, and this log describes process creation and a connection, not a chain check. The NetFlow sampling rate in use on campus routers while that outbound connection stayed open is a router export setting and is not a field of the host command-line log. On the exam, this behavior supports a containment review and does not become a passport name, a certificate-chain failure, or a router sampling rate. In operations, record the parent, the child, the command lines, and the remote address while the processes are still running, before the host is powered off.