3.7 200-201 Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   In host-based analysis, which hash algorithm is commonly used to generate a unique identifier for malware samples because it produces a 256-bit digest and is widely supported by threat intelligence platforms?

   • ASHA-1
   • BSHA-256
   • CCRC32
   • DMD5
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which technique is commonly used to attribute a specific network connection to a user account on a host?

   • ACorrelating the connection's timestamp and source port with the user's logon and process creation events
   • BAnalyzing the packet's TTL value
   • CChecking the firewall's rule name
   • DPerforming a reverse DNS lookup on the destination IP
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst is verifying the integrity of a downloaded software installer. The vendor provides a SHA-256 hash on their website. The analyst computes the hash of the downloaded file and it matches. Later, the analyst discovers that the vendor's website was compromised and the hash was replaced by the attacker. What is the primary limitation of this hash verification?

   • ASHA-256 is not collision-resistant, so the attacker could have created a different file with the same hash.
   • BThe hash is deterministic, so it cannot be used to detect changes.
   • CThe analyst should have used MD5 instead because it is faster.
   • DThe hash only verifies that the file matches the provided hash, not that the hash is authentic.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security analyst is investigating a Windows server that was compromised. The Security log shows a successful logon for a service account at 03:00, but the account is not supposed to be used at that time. The System log shows a service failure at 03:01, and the firewall log shows an outbound connection to an external IP at 03:02. The analyst also finds a scheduled task that runs a PowerShell script every hour. Which hypothesis is most supported by the evidence?

   • AThe service account was compromised and used to execute the PowerShell script, which caused the service failure and outbound connection.
   • BThe scheduled task is the root cause of all events, and the logon is a normal system event.
   • CThe firewall log is the only evidence of compromise, and the host logs are irrelevant.
   • DThe service failure caused the outbound connection, and the logon is unrelated.
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   In Linux, which log file typically contains authentication-related events such as user logins and sudo usage?

   • A/var/log/auth.log
   • B/var/log/boot.log
   • C/var/log/kern.log
   • D/var/log/messages
   Reveal Solution Discussion Select an answer first