3.7 200-201 Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   An analyst is triaging a URL that appeared in an email: hxxp://example[.]com/paypal/login. The analyst needs to determine if this URL is malicious. Which first step is most appropriate?

   • ASubmit the URL to a reputation service after deobfuscating it
   • BOpen the URL in a browser to see where it leads
   • CSearch the raw URL in a search engine
   • DPing the domain to check if it resolves
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which log source is most likely to contain records of allowed and denied traffic based on security policies?

   • AWindows Event Logs
   • BApplication logs
   • CDNS logs
   • DFirewall logs
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   An analyst extracts the following string from a proxy log: hXXp://example[.]com. What is the likely reason for this format?

   • AIt is an encoded URL that needs to be decoded
   • BIt is a redirect URL
   • CIt is a typo in the log
   • DIt is a URL obfuscation technique to evade detection
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   During a threat hunt, an analyst extracts an MD5 hash of a suspicious file from an endpoint. The analyst queries a public threat intelligence platform and finds no matches. The analyst then computes a SHA-256 hash of the same file and queries again, finding a match to a known malware family. Why did the SHA-256 query succeed when the MD5 query did not?

   • AThreat intelligence platforms only store SHA-256 hashes, not MD5 hashes.
   • BThe threat intelligence source had a SHA-256 hash for that file but not the corresponding MD5 hash.
   • CSHA-256 is a stronger algorithm, so it always produces a match when MD5 does not.
   • DThe MD5 hash was computed incorrectly, while the SHA-256 hash was correct.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   An analyst is investigating a potential data exfiltration. The firewall log shows a large outbound transfer from a workstation to an external IP at 02:00. The Windows Event log shows a scheduled task ran at 01:55 that executed a PowerShell script. The analyst also finds a file named 'archive.zip' created at 01:58. What is the most likely sequence of events?

   • AThe events are unrelated and coincidental.
   • BThe outbound transfer triggered the scheduled task, which then created the archive.
   • CThe archive was created first, then the scheduled task ran, and then the transfer occurred.
   • DThe scheduled task ran the PowerShell script, which created the archive, and then the archive was exfiltrated.
   Reveal Solution Discussion Select an answer first