Cisco CyberOps Associate (CBROPS) 200-201Security MonitoringMedium
A security analyst is investigating a host that is unresponsive and exhibiting extremely high CPU utilization. Process monitoring shows a single process consuming nearly 100% of the CPU, and its memory footprint is unusually large and constantly growing. The process name is generic (e.g., 'svchost.exe' on Windows, but not a legitimate system process). What type of host-based intrusion is most likely occurring?
- ARootkit Installation
- BMemory Exhaustion / Resource Hogging Malware
- CBackdoor Activation
- DPrivilege Escalation
Show answer & explanationAnswer & explanation
Correct answer: B. Memory Exhaustion / Resource Hogging Malware
Extremely high CPU utilization, unusually large and growing memory footprint, and an unresponsive system caused by a single, generic-named process are strong indicators of malware designed to consume system resources, often for cryptocurrency mining or as part of a denial-of-service against the host itself.
Why the other options are wrong
- A. Rootkits aim to hide their presence, not necessarily cause high CPU/memory usage leading to unresponsiveness.
- C. Backdoors provide covert access, but don't necessarily manifest as extreme resource consumption and system unresponsiveness.
- D. Privilege escalation is about gaining higher access, not directly about resource consumption causing system unresponsiveness.
Resource Hogging Malware
Resource hogging malware is malicious software designed to consume excessive system resources (CPU, memory, disk I/O, network bandwidth), leading to severe performance degradation or system crashes.
- Symptoms: high CPU/memory usage, slow system, unresponsiveness.
- Often associated with cryptocurrency miners (cryptojacking).
- Can also be used for self-DoS or to mask other activities.
- Detection via process monitoring, resource utilization tools.
Memory trick: Resource anomalies are like your computer suddenly 'running a marathon' with no warning.