Exam CS0-004 Topic 1 Question 143 Discussion

Actual exam question for CompTIA's CS0-004 exam
Question #: 143
Topic #: 1
A security analyst must identify documents that contain encoded ActiveMime payloads in a directory containing thousands of files. The analyst runs the following command:
grep -rail ActiveMime *
The command returns no output. Which of the following Yet Another Recursive Acronym (YARA) rules should the analyst use to find the suspicious files?

Suggested Answer: C Vote an answer

The payload contains an encoded ActiveMime string, so the YARA base64 modifier searches for its Base64-encoded forms. A normal grep search cannot find the plaintext string.

by Pearl at Oct 29, 2026, 10:29 AM

Limited Time Offer

15%

Off

Get Premium CS0-004 Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10