3.7 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is investigating a potential malware infection. The firewall log shows repeated outbound connections to a known malicious IP on port 53 (DNS). The Windows Event log shows a process named 'svchost.exe' running from a non-standard path (C:\Users\Public\svchost.exe). The analyst also sees a scheduled task that runs this process at system startup. What is the most likely explanation?

   • AThe process is a false positive because svchost.exe is a trusted Windows process.
   • BThe scheduled task is the only suspicious item, and the process is legitimate.
   • CThe process is likely malware masquerading as svchost.exe, using DNS for command-and-control communication.
   • DThe process is a legitimate svchost.exe running from a non-standard path, and the DNS connections are normal.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Windows host's Security log shows Event ID 4624 (successful logon) for user 'admin' at 02:00 from an IP address that is not in the company's known range. The same host also shows Event ID 4688 for a process named 'cmd.exe' at 02:01. The analyst suspects lateral movement. Which additional evidence would most strongly support this hypothesis?

   • AA network log showing an SMB connection from the external IP to the host at 02:00
   • BA DNS log showing a query for an internal domain at 02:05
   • CA firewall log showing outbound HTTPS traffic at 02:10
   • DA PowerShell script block log showing a script at 02:02
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An organization maintains a file integrity monitoring (FIM) system that stores SHA-256 hashes of critical system files. During a routine check, the FIM reports that a critical executable's hash has changed. The analyst verifies the new hash against the vendor's official release notes and finds that the vendor released a security patch that updated the executable. What is the most appropriate conclusion?

   • AThe analyst should immediately quarantine the system because any hash change is malicious.
   • BThe FIM system is malfunctioning because SHA-256 hashes should never change.
   • CThe file was modified by an attacker, and the hash change indicates a compromise.
   • DThe hash change is expected because the vendor released a patch, so no further action is needed.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A firewall log shows a connection from a host to an external IP on port 53 (DNS). The host's DNS log shows a query for 'update.example.com' at the same time. The host's process log shows 'svchost.exe' making the connection. The analyst must determine if this is malicious. What is the most important next step?

   • ABlock all DNS traffic from the host
   • BAssume it is benign because svchost.exe is a legitimate Windows process
   • CCheck if 'update.example.com' resolves to a known malicious IP
   • DIgnore the event because DNS traffic is normal
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is deploying a SIEM and needs to collect logs from Windows workstations, Linux servers, and network firewalls. The security team has limited resources and wants to prioritize log sources that provide the most security-relevant information. Which log source should be prioritized first?

   • ALinux syslog, because it contains all system events.
   • BFirewall logs, because they contain all network connections.
   • CAll log sources are equally important, so prioritization is not necessary.
   • DWindows Security logs, because they contain authentication and process creation events.
   Reveal Solution Discussion Select an answer first