Which Command Should the Administrator Use Practice Questions

1. Enter global configuration mode 2. Create access-list rules 3. Configure interfaces (nameif, ip address, security-level) 4. Apply access-list to interface 5. Verify configuration

Why wrong: Creating an ACL before configuring interfaces is incorrect because interfaces must be named and have IP addresses before you can apply the ACL. Additionally, ACLs often reference interface-specific criteria.

1. Enter global configuration mode 2. Configure interfaces (nameif, ip address, security-level) 3. Create access-list rules 4. Verify configuration 5. Apply access-list to interface

Why wrong: Verifying before applying the ACL will show connectivity without the intended restrictions, giving a false positive. The ACL must be applied first to enforce the policy.

1. Enter global configuration mode 2. Create access-list rules 3. Apply access-list to interface 4. Configure interfaces (nameif, ip address, security-level) 5. Verify configuration

Why wrong: Applying an ACL before configuring interfaces will fail because the interface does not exist yet. You must first configure interfaces to have a valid target for the ACL application.

netstat -anp

Why wrong: While netstat can show connections, it is deprecated and less reliable than ss.

cat /proc/net/tcp

Why wrong: This file contains raw TCP connection data but does not directly associate processes.

lsof -i TCP

Why wrong: lsof shows open files, including network sockets, but the syntax for processes is different.

tcpdump -r traffic.pcap -X | grep 'string'

Why wrong: -X prints hex and ASCII; not focused on POST URI.

ngrep -q -W byline 'POST.*string' port 80

Why wrong: ngrep is not tcpdump, and -W byline might not extract full request.

tcpdump -r traffic.pcap -nn 'host 10.0.0.1'

Why wrong: Filters by IP, not HTTP content.

Pretexting and privilege escalation

Why wrong: Pretexting involves a fabricated scenario, but the attacker did not escalate privileges afterward.

Phishing and man-in-the-middle

Why wrong: There is no evidence of man-in-the-middle; the attacker directly used the credentials.

Vishing and brute force

Why wrong: Vishing is voice phishing; no voice was used. Brute force was not attempted.

Traffic will be allowed, but logged

Why wrong: Traffic is denied, not allowed.

Traffic will be allowed only if it matches the subnet

Why wrong: No rule permits traffic from the internet to the inside subnet.

Traffic will be permitted

Why wrong: Only traffic to the web server is permitted.

The attacker is using a brute-force tool that bypasses account lockout

Why wrong: Account lockout is a server-side setting; brute-force tools cannot bypass it if properly enforced.

The server's logging is not capturing all authentication events

Why wrong: Logging issues could cause inconsistencies, but the scenario describes a typical multi-username attack.

The SIEM alert is a false positive due to a misconfiguration

Why wrong: While possible, the described behavior is more consistent with a targeted attack using multiple usernames.

services.msc

Why wrong: services.msc is a GUI tool, not a command-line command.

net start

Why wrong: net start lists running services but not their configuration.

tasklist /svc

Why wrong: tasklist /svc shows services hosted in each process, not service details.

services.msc

Why wrong: services.msc is a GUI tool, not command-line.

tasklist /svc

Why wrong: tasklist /svc maps processes to services but does not show service configuration.

net start

Why wrong: net start only lists running services, not configuration details.

dlllist

Why wrong: dlllist lists loaded DLLs but does not detect injected code directly.

netscan

Why wrong: netscan shows network connections, not injected code.

pslist

Why wrong: pslist lists processes but does not detect injected code.

ps aux | grep [pid]

Why wrong: ps aux shows processes but not the full command line if truncated, and doesn't directly give parent-child relationships as efficiently.

journalctl -u unknown.service

Why wrong: The process is not associated with a systemd unit, so this won't work.

ss -tlnp | grep [pid]

Why wrong: ss shows network connections but not process parent details.

Digital signature and symmetric encryption

Why wrong: Missing hashing for integrity; symmetric encryption adds confidentiality but not integrity.

Symmetric encryption and hashing

Why wrong: Symmetric encryption provides confidentiality, not authentication.

Asymmetric encryption and hashing

Why wrong: Asymmetric encryption alone doesn't provide integrity; digital signatures use asymmetric keys to sign a hash.

Man-in-the-middle attack

Why wrong: MITM intercepts traffic, not login attempts.

DDoS attack

Why wrong: DDoS involves many sources, not one.

SQL injection attempt

Why wrong: SQL injection targets web applications via crafted queries.

Sender's private key

Why wrong: The sender's private key is used to sign, not verify.

Recipient's public key

Why wrong: The recipient's keys are not involved in verifying the sender's signature.

Recipient's private key

Why wrong: The recipient's private key is used for decryption, not signature verification.

-w /etc/shadow -p x

Why wrong: The -p x flag monitors execute access.

-w /etc/shadow -p a

Why wrong: The -p a flag monitors attribute changes, not reads.

-w /etc/shadow -p w

Why wrong: The -p w flag monitors write access.

The user is granted access to user EXEC mode only

Why wrong: User EXEC access is granted via local-case; enable access fails.

The user is denied all access because no enable secret is set

Why wrong: User EXEC still works with local case.

The user is granted full privileged EXEC access

Why wrong: Enable authentication uses 'enable' method, which fails without enable secret.