hardMultiple ChoiceObjective-mapped

CISA Practice Question: Refer to the exhibit

Exhibit

Refer to the exhibit.

Exhibit:
Extract from a server audit log:
[2024-03-20 08:12:34] User: admin (privileged) executed: cmd.exe /c "taskkill /F /IM svchost.exe"
[2024-03-20 08:12:37] System event: Service 'Windows Update' stopped unexpectedly.
[2024-03-20 08:12:40] System event: Security Center service stopped.
[2024-03-20 08:12:45] Network connection from 10.0.0.50 to 203.0.113.5 on port 4444 (outbound) established.

Refer to the exhibit. A CISA is analyzing these logs. What is the MOST likely security incident?

⚠ Common exam trap

The trap here is that candidates may mistake the single successful admin login as a brute force success (option B), but the subsequent reverse shell activity is the definitive indicator of a compromised account used for C2, not just credential guessing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Compromised administrator account used to establish a command and control channel

The logs show the administrator account executing a reverse shell connection (e.g., using PowerShell or netcat) to an external IP address on a non-standard port (e.g., 4444 or 8080). This outbound connection initiated by the admin account is a classic indicator of a command and control (C2) channel, where an attacker who has compromised the account uses it to maintain persistent remote access. Legitimate administrative activity would not typically involve establishing a reverse shell to an unknown external host.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Legitimate system maintenance activity
Why it's wrong here
Killing svchost.exe and connecting to an external IP on port 4444 is not normal maintenance.
✗
Brute force attack on the administrator account
Why it's wrong here
No failed login attempts are shown.
✗
Unauthorized installation of a critical update
Why it's wrong here
The command kills svchost.exe, not installs updates.
✓
Compromised administrator account used to establish a command and control channel
Why this is correct
The attacker disabled a key process and set up a backdoor.

Go deeper

CISA Practice Question: Refer to the exhibit

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question