CFR-410 practice question 1 of 25
A secretary receives an email from a friend with a picture of a kitten in it. The secretary forwards it to the ~COMPANYWIDE mailing list and, shortly…
Full set: 180 questionsThe provided code executes a PowerShell command within an infinite loop (do...while(1)). The core of this loop is the shutdown command and a Start-Sleep cmdlet. The shutdown /r switch specifically instructs the operating system to reboot, not shut down. The /c switch displays the taunting message. The Start-Sleep –s 900 command pauses the script's execution for 900 seconds. Converting seconds to minutes (900 / 60) equals 15 minutes. Therefore, the script's intent is to display the message and initiate a system reboot every 15 minutes.
A. The shutdown command uses the /r switch, which explicitly means to reboot the computer, not shut it down.
C. This is incorrect on two points: the command is for a reboot (/r), and the interval is 15 minutes (900 seconds), not 900 minutes.
D. The time interval specified by Start-Sleep –s 900 is 900 seconds, which translates to 15 minutes, not 900 minutes.
1. Microsoft Corporation. (n.d.). Shutdown Command-Line Options. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown. (This document confirms that the /r parameter is used to "Restart the computer.")
2. Microsoft Corporation. (2023, July 27). Start-Sleep. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/start-sleep. (This official documentation specifies that the -s or -Seconds parameter "Specifies how long the resource sleeps in seconds.")
3. Purdue University. (n.d.). Malware and Malicious Code. Courseware for CS 42600 (Computer Security). Retrieved from https://www.cs.purdue.edu/homes/ninghui/courses/426Fall15/lectures/21-malware.pdf. (Page 4 discusses how malware, such as logic bombs, can execute payloads that include system commands like shutdown to disrupt operations, which is consistent with the scenario.)
Keep practicing
Take the free CFR-410 practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CFR-410 practice questions
- Question 2Which of the following should normally be blocked through a firewall?
- Question 3Tcpdump is a tool that can be used to detect which of the following indicators of comprom…
- Question 4What are the two most appropriate binary analysis techniques to use in digital forensics …
- Question 5A user receives an email about an unfamiliar bank transaction, which includes a link. Whe…
- Question 6When performing a vulnerability assessment from outside the perimeter, which of the follo…
- Question 7Which of the following can increase an attack surface?
