3.7 200-201 Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   During incident response, an analyst computes the MD5 hash of a critical system file and compares it to a known-good baseline. The hashes do not match. What is the most likely conclusion?

   • AThe file has been modified or replaced
   • BThe hash algorithm is incorrect
   • CThe file is corrupted due to disk errors
   • DThe file is encrypted
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst sees the following URL in a proxy log: http://192.168.1.10/%77%77%77%2Eexample%2Ecom. Which obfuscation technique is being used?

   • AURL encoding of the path to hide the real destination
   • BUsing an IP address instead of a domain name
   • CRedirect via an open redirector
   • DUsing a punycode domain
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An analyst is reconstructing an attack timeline. The following events were collected: 10:00:00 - User opens a phishing email attachment; 10:05:00 - Firewall logs show an outbound connection to a known C2 IP; 10:10:00 - Windows Security log shows a new service installed. What is the correct chronological order of the attack phases?

   • AInitial access, command and control, persistence
   • BInitial access, persistence, command and control
   • CCommand and control, initial access, persistence
   • DPersistence, command and control, initial access
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A Windows workstation's Security event log shows Event ID 4624 (successful logon) at 10:00:00, followed by Event ID 4688 (process creation) for cmd.exe at 10:00:05, and then a network connection event to an external IP at 10:00:10. The analyst also sees a firewall log entry showing an outbound connection from that workstation to the same external IP at 10:00:10. What is the most reasonable interpretation?

   • AThe firewall log is the only reliable evidence of malicious activity.
   • BThe logon event is false because the user was already logged in.
   • CThe events are unrelated and should be investigated separately.
   • DThe logon, process creation, and network connection are part of a single attack chain.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   When correlating network and host-based events, which piece of information from a firewall log is most useful for matching a connection to a specific process on a host?

   • AThe firewall's interface name
   • BThe firewall's rule name
   • CSource and destination IP addresses and ports
   • DThe packet's TTL value
   Reveal Solution Discussion Select an answer first