A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command: However, the analyst is unable to find any evidence of the running shell. Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?
A) The NX bit is enabled
B) The system uses ASLR
C) The shell is obfuscated
D) The code uses dynamic libraries

Question

A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:  However, the analyst is unable to find any evidence of the running shell. Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?
A) The NX bit is enabled 
B) The system uses ASLR 
C) The shell is obfuscated 
D) The code uses dynamic libraries

Quizplus · Accepted Answer

The Answer of A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:  However, the analyst is unable to find any evidence of the running shell. Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?
A) The NX bit is enabled 
B) The system uses ASLR 
C) The shell is obfuscated 
D) The code uses dynamic libraries

A Forensic Analyst Suspects That a Buffer Overflow Exists in a Kernel