At an agency, a new process whose name looks like a remote shell is running beside the usual web process on a server. Which server-profile element is this?
Select an answer to reveal the explanation.
Short Explanation
The roster on the wall lists who is working in the room right now. You are looking at a new process beside the usual web process, which is the running-process element of the server profile. The trap is answering with an address range, a mail label, or the artwork on the plan.
Full Explanation
A server profile includes the processes running on the host, along with listening ports, logged-on users, tasks, and applications. A new process whose name looks like a remote shell, running beside the usual web process, is a change in that process list. The element is "Running processes, including a new process named like a remote shell beside the usual web process". "Critical-asset address space, the address ranges the agency marks as highest priority on its network" is a network-profile field about which addresses matter, and it does not name a process on this server. "A mail-filter category, the label the agency gateway applies to classes of inbound messages" classifies email at a gateway, and this fact is a process on a server rather than a mail label. "The incident-plan cover logo, the image printed on the front of the agency response document" is artwork on a document, and it is not a field in the server profile at all. Exam caveat: a suspicious name is a reason to inspect the process, and the profile element you are filling in is still running processes even before you decide the binary is malicious. Operational check: record the process name, parent, user, and start time, compare them with the server baseline that listed only the web process, and keep the binary for a hash before you kill it.