2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A user reports that their computer is running slowly and displaying pop-ups. The security team finds a program that was installed alongside a free software download. The program is not malicious by itself but displays advertisements. Which type of malware is this?

   • AWorm
   • BAdware
   • CRansomware
   • DRootkit
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is monitoring network traffic and notices that a host is sending small, periodic DNS queries to a domain that is not in any threat intelligence feed. The queries are for A records, and the responses contain data that is not typical for DNS. The analyst suspects DNS tunneling. Which additional evidence would most strongly confirm DNS tunneling?

   • AThe DNS queries are occurring at regular intervals.
   • BThe domain has a low reputation score and was recently registered.
   • CThe DNS responses contain encoded data that, when decoded, matches commands sent to the host.
   • DThe host is also making HTTP requests to the same domain.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing network logs and sees that a workstation is communicating with an external IP address on port 443 at regular intervals. The traffic is encrypted and the destination is a known malicious IP. The analyst suspects the workstation is compromised. Which behavior is most indicative of C2 communication?

   • ALarge file transfers to a cloud storage service
   • BA single connection to a legitimate website
   • CDNS queries to a well-known public DNS server
   • DRegular, periodic connections to a known malicious IP
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has experienced a ransomware attack that encrypted files on a network share. The IT team has offline backups, but the last backup was 24 hours old. The company's leadership is considering paying the ransom to get the decryption key. Which factor should the security team emphasize in their recommendation?

   • AThe company should reimage all systems and not restore any data to avoid reinfection.
   • BThe company should attempt to use free decryption tools before considering backups.
   • CPaying the ransom is the fastest way to recover data and should be done immediately.
   • DRestoring from backups is preferable because paying the ransom does not guarantee decryption and funds criminal activity.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company's endpoint protection alerts on a file that is attempting to access the Windows Registry and create a run key. The file was downloaded from a malicious website. Which stage of the ransomware lifecycle is this activity most associated with?

   • APersistence and privilege escalation, which often occur after initial infection and before encryption.
   • BRansom demand, because the run key is used to display the ransom note.
   • CEncryption, because the registry is being modified to store encryption keys.
   • DInitial infection, because the file was downloaded from a malicious website.
   Reveal Solution Discussion Select an answer first