Discuss GIAC GCED Exam Topic 7 Question 12

You are responding to an incident involving a Windows server on your company's network. During the investigation you notice that the system downloaded and installed two files, iexplorer.exe and iexplorer.sys. Based on the behavior of the system you suspect that these files are part of a rootkit. If this is the case what is the likely purpose of the .sys file?

AIt is a configuration file used to open a backdoor

BIt is a logfile used to collect usernames and passwords

CIt is a device driver used to load the rootkit

DIt is an executable used to configure a keylogger

Suggested Answer: C

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Ty 11 months ago

I thought .sys files were just for system stuff, this is wild!

Krystal 11 months ago

Definitely a driver, no doubt about it.

Sue 12 months ago

Wait, could it be a backdoor instead?

Markus 12 months ago

Totally agree, it’s likely loading the rootkit.

Teri 12 months ago

.sys files are usually device drivers.

Na 1 year ago

I'm torn between A and C. A .sys file sounds like it would be more about loading something, but I guess it could also be used for logging.

Jacqueline 1 year ago

I feel like I've seen a question like this before. If it's a rootkit, then the .sys file must be a driver to help it run undetected.

Janey 1 year ago

I remember studying rootkits, and I think .sys files usually relate to drivers. But could it also be a backdoor?

Cyndy 1 year ago

I think the .sys file is likely a device driver, but I'm not entirely sure. It seems like it could be used to load the rootkit, right?

Ronny 1 year ago

This looks like a pretty straightforward OSPF configuration question. I think the key is to find the command that will prevent the router from sending OSPF hellos on the specified interface.

Cammy 1 year ago

Okay, I've got this. Provisioning is about granting licensed modules the appropriate resource levels, so I'll go with option B.

Buffy 1 year ago

I'm a little confused by the wording of the question. I'll need to re-read it a few times to make sure I'm understanding the requirements correctly before selecting an answer.

GIAC GCED Exam - Topic 7 Question 12 Discussion