Which Command Should the Administrator Use Practice Questions

1. Enter global configuration mode 2. Create access-list rules 3. Configure interfaces (nameif, ip address, security-level) 4. Apply access-list to interface 5. Verify configuration

Why it fails: Creating an ACL before configuring interfaces is incorrect because interfaces must be named and have IP addresses before you can apply the ACL. Additionally, ACLs often reference interface-specific criteria.

1. Enter global configuration mode 2. Configure interfaces (nameif, ip address, security-level) 3. Create access-list rules 4. Verify configuration 5. Apply access-list to interface

Why it fails: Verifying before applying the ACL will show connectivity without the intended restrictions, giving a false positive. The ACL must be applied first to enforce the policy.

1. Enter global configuration mode 2. Create access-list rules 3. Apply access-list to interface 4. Configure interfaces (nameif, ip address, security-level) 5. Verify configuration

Why it fails: Applying an ACL before configuring interfaces will fail because the interface does not exist yet. You must first configure interfaces to have a valid target for the ACL application.

dlllist

Why it fails: dlllist enumerates DLLs loaded by a process from the PEB's loader lists, so injected or hidden modules absent from those lists are not revealed. It is tempting for module inspection; malfind detects injected code by scanning for executable memory regions lacking a mapped file backing.

netscan

Why it fails: netscan enumerates network connections and listening sockets from pool scanning, which is unrelated to locating injected code inside a process address space. It is tempting during incident triage for command-and-control connections; malfind is the plugin that flags injected executable memory.

pslist

Why it fails: pslist walks the active process list, so it enumerates running processes but cannot reveal injected or hidden code inside them; that requires malfind, which scans for suspicious memory regions. It is tempting because pslist is the standard first step for listing processes during triage, and would be correct when simply confirming which processes were running.

SSL VPN

Why it fails: An SSL VPN grants remote users access to internal resources through a browser or client tunnel; the exhibit depicts site-to-site gateway configuration, not remote-access termination. It is tempting because SSL VPNs do encrypt over untrusted networks, and would be correct for mobile or home workers connecting to the corporate network.

MACsec

Why it fails: MACsec operates at layer 2, encrypting hop-by-hop Ethernet frames between directly connected devices; it cannot secure traffic across routed layer 3 boundaries shown in the exhibit. It is tempting because MACsec genuinely protects LAN links, and would be correct for switch-to-switch or host-to-switch wire encryption.

SSH

Why it fails: SSH secures remote terminal sessions and file transfer, not the exhibit's traffic. It is tempting because SSH does encrypt management access, and it would be correct where the requirement is hardened administrative login to network devices rather than the protocol shown.

The IDS interface is set to promiscuous mode.

Why it fails: Promiscuous mode is required for a SPAN destination to accept copied frames; disabling it would drop all monitored traffic, not just one VLAN. It is the correct setting for capturing mirrored traffic, so it cannot explain a single missing VLAN.

The SPAN destination port is in trunk mode.

Why it fails: A SPAN destination port carries copied frames as ordinary untagged traffic; configuring it as a trunk does not add VLAN tags, so the IDS still cannot identify the missing VLAN. Trunking the destination is tempting because trunk links carry multiple VLANs, and it would be right if the IDS needed to receive tagged frames from several VLANs.

The IDS is in inline mode.

Why it fails: Inline mode describes a deployment where traffic passes through the sensor; it does not prevent a SPAN port from delivering copied frames. Inline placement is chosen deliberately when the device must block malicious traffic, not merely monitor it passively.

1. Generate RSA keys 2. Configure hostname and domain name 3. Create a local user account 4. Configure VTY lines to use SSH transport

Why it fails: This order is incorrect because RSA key generation requires the domain name to be set first. Without a domain name, the key generation will fail or produce incomplete keys.

1. Create a local user account 2. Configure hostname and domain name 3. Generate RSA keys 4. Configure VTY lines to use SSH transport

Why it fails: This order is incorrect because the hostname and domain name should be configured before RSA key generation. Additionally, while creating the user before keys is not strictly wrong, it is not the typical sequence and may cause confusion if keys are not available for SSH.

1. Configure VTY lines to use SSH transport 2. Generate RSA keys 3. Configure hostname and domain name 4. Create a local user account

Why it fails: This order is incorrect because SSH cannot be enabled on VTY lines until encryption keys are generated, and key generation requires the domain name. Also, the local user must be created before SSH is attempted to allow authentication.

Enter global configuration mode, then name the VLAN, then create the VLAN, then assign ports to the VLAN.

Why it fails: You cannot name a VLAN before it exists. The VLAN must be created first before you can assign a name to it.

Create the VLAN, then enter global configuration mode, then name the VLAN, then assign ports to the VLAN.

Why it fails: You must be in global config mode to create a VLAN. The command 'vlan vlan-id' is executed from global config mode, not before.

Enter global configuration mode, then create the VLAN, then assign ports to the VLAN, then name the VLAN.

Why it fails: While you can technically assign ports before naming, it's best practice to name the VLAN while still in VLAN config mode. More importantly, if you exit VLAN config mode before naming, you must re-enter it. Standard order puts naming before port assignment to keep steps logical.

Pretexting

Why it fails: Pretexting is a social-engineering technique using a fabricated scenario, typically by phone or in person, to extract information through a false identity. It is tempting because the email does invent a bank scenario, but pretexting lacks the mass email lure and malicious link that define phishing.

Vishing

Why it fails: Vishing is voice phishing conducted over telephone calls, using spoken conversation to manipulate the victim. It is tempting because it also impersonates a trusted organisation, but this attack arrives by email with a clickable link, so no voice channel is involved.

Spear phishing

Why it fails: Spear phishing targets specific, previously researched individuals or small groups with tailored messages, whereas this email is an untargeted bulk lure impersonating a bank. It is tempting because the message is crafted to look legitimate, but the absence of individual reconnaissance makes it generic phishing.

Decrypt the file using the publisher's public key

Why it fails: Public-key decryption applies to data encrypted with the matching private key, which is not how a hash file is produced. It is the right choice for reading a confidential message sent to the key owner, not for confirming a download matches the publisher's published hash.

Use a digital signature to sign the file

Why it fails: Signing the file creates a signature; it does not compare the publisher's supplied hash against a locally computed one, so tampering goes undetected. Digital signatures suit verifying authenticity and origin when the publisher signs and the analyst holds the public key, not integrity checking against a provided hash value.

Encrypt the file using the publisher's private key

Why it fails: Encrypting with a private key produces a signature, not a hash comparison, and the analyst lacks that private key anyway. It is the right choice for the publisher proving authenticity via a digital signature, not for verifying integrity against a supplied hash value.

IPS hardware failure

Why it fails: Hardware failure would halt all inspection or cause the sensor to fail open or closed, not selectively drop traffic matching one SQL injection signature. Hardware replacement is the right response when the appliance itself is down, but here the signature is matching legitimate requests, indicating a false positive.

Network congestion

Why it fails: Congestion delays or drops packets indiscriminately across all flows, not only those matching the SQL injection signature. Bandwidth upgrades or QoS are correct when throughput is the bottleneck, but legitimate web traffic being blocked by a specific signature points to signature tuning, not link saturation.

Signature false negative

Why it fails: A false negative means malicious traffic passes uninspected; the stem describes legitimate traffic being blocked, which is a false positive. False negatives are addressed by adding or tightening signatures, whereas here the SQL injection signature is over-matching benign requests and needs tuning or exception rules.

Digital signature and symmetric encryption

Why it fails: Symmetric encryption alone cannot verify sender identity, since both parties share one key, so no origin proof exists; a digital signature already supplies integrity and authentication. Symmetric encryption suits bulk data confidentiality, such as encrypting large files at rest, not proving authorship or detecting tampering.

Symmetric encryption and hashing

Why it fails: Hashing detects alteration but provides no sender authentication, and symmetric encryption's shared key means either party could have produced the document. This pairing suits verifying file integrity during transfer between trusted parties, not confirming which specific identity originated and signed the content.

Asymmetric encryption and hashing

Why it fails: Asymmetric encryption and hashing supply confidentiality and integrity but not origin authentication, because anyone holding the public key can encrypt; hashing alone cannot bind an identity. This combination suits encrypting data to a recipient and checking it arrived unchanged, not proving the sender's identity.

netstat -an

Why it fails: netstat -an shows all sockets numerically but includes established and UDP entries alongside listeners, so it does not filter to listening TCP ports. It is tempting because netstat is the classic socket inspection tool, and it would be correct if the requirement were simply to view all connections without filtering.

lsof -i

Why it fails: lsof -i lists open Internet sockets, including established connections and UDP, so it does not isolate listening TCP ports alone. It is tempting because lsof genuinely maps sockets to owning processes, which would be the right tool when you need to attribute a port to a specific PID.

ps aux

Why it fails: ps aux enumerates running processes with CPU and memory usage; it reads process tables, not socket state, so no port information appears. It is tempting because a listening port implies a listening daemon, and ps aux would be the correct choice when identifying which process owns a service.

services.msc

Why it fails: services.msc launches the graphical Services console, not a command-line tool, so it fails the stem's requirement for command-line querying during host-based analysis. It tempts because it displays service status, startup type and binary path, making it the natural choice when interactive GUI access to the host is available.

tasklist /svc

Why it fails: tasklist /svc maps running processes to the services hosted inside them, but it reports neither startup type nor binary path, so an auto-starting suspicious service cannot be identified from it. It tempts because it is command-line and service-aware, yet it suits live process-to-service correlation, not configuration auditing.

net start

Why it fails: net start lists only running services and can start or stop them; it cannot display binary paths, startup configuration or non-standard service names, so suspicious paths stay hidden. It tempts because it is a genuine command-line service tool, but it is the correct choice for controlling services, not auditing their configuration.

systemctl stop servicename

Why it fails: systemctl stop halts the running unit for the current session only; the service's enablement symlinks remain, so it restarts at the next boot. systemctl disable removes those symlinks, preventing automatic startup. Stopping is tempting for immediate containment during triage, but it does not satisfy the requirement to stop the service starting automatically.

systemctl remove servicename

Why it fails: systemctl has no remove subcommand; units are deleted by removing their unit files, not through systemctl. The correct action, systemctl disable, removes the enablement symlinks so the service stops starting automatically. The verb 'remove' is tempting because it sounds like deleting the service, but it is not a valid systemctl operation.

systemctl mask servicename

Why it fails: systemctl mask links the unit to /dev/null, preventing it from being started manually or as a dependency, which is stronger than the question's requirement. systemctl disable removes the enablement symlinks so the service no longer starts automatically at boot. Masking is tempting for hard-blocking a malicious unit, but it exceeds what disabling alone demands.

vol.py netscan

Why it fails: netscan enumerates network endpoints and sockets from pool tagging, so it cannot surface injected code inside a process's memory. It is tempting because it is the standard Volatility plugin for spotting suspicious connections during incident triage, and would be correct when the question asks which established remote sessions or listening ports a compromised host held.

vol.py pslist

Why it fails: pslist enumerates processes from the active process list, which rootkits can unlink, so injected or hidden code stays invisible. It is tempting because it is the standard first listing command, so it would be correct for a quick overview of running processes before deeper scanning with malfind or psscan.

vol.py dlllist

Why it fails: dlllist walks the loaded-module list in the PEB, so code injected without a corresponding loader entry stays invisible; malfind instead scans for executable pages lacking file backing. It is tempting because dlllist is the natural plugin for enumerating a process's DLLs, and would be correct when asked which libraries a process loaded.

Public key encryption

Why it fails: Public key encryption provides confidentiality by encrypting with the recipient's public key; it does not by itself prove the file is unaltered. A cryptographic hash compared against the published digest detects modification. Public key encryption suits protecting data in transit or at rest for a specific recipient.

Symmetric encryption

Why it fails: Symmetric encryption uses one shared key for both encryption and decryption, so it provides confidentiality but produces no separate value that verifies integrity against the original. A hash such as SHA-256 compared with the publisher's digest detects alteration. Symmetric encryption suits bulk data-at-rest protection where both parties already share the key.

Digital signature

Why it fails: A digital signature verifies authenticity and non-repudiation via asymmetric cryptography, but it does not directly confirm that a file remained unaltered during transit unless the signer’s public key is already trusted and the signature was applied before download. The stem asks solely for integrity verification of a downloaded file, which a hash function (e.g., SHA-256) achieves by comparing a pre-computed digest against a freshly computed one. This option is tempting because digital signatures do include a hash, but their primary purpose is to authenticate the signer’s identity and prove origin, making them correct when the requirement is to validate the source rather than just detect transit tampering.