2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing a crash dump from a legacy Windows application that processes user-supplied filenames. The crash occurs when a filename longer than 260 characters is passed to a function that copies it into a fixed 128-byte buffer. The analyst notices that the return address of the function was overwritten with data from the filename. Which type of endpoint attack is this an example of, and what is the most likely immediate impact?

   • ABuffer overflow; the overwritten return address could allow arbitrary code execution when the function returns.
   • BDenial of service; the crash is the only impact because modern OS memory protection prevents code execution.
   • CInteger overflow; the filename length wraps around and causes the buffer to be allocated too small.
   • DFormat string vulnerability; the long filename causes the application to print memory contents to the console.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's files are encrypted by ransomware. The ransom note demands payment in Bitcoin and threatens to delete the decryption key if payment is not made within 72 hours. The company has offline backups that were last tested a month ago. What is the best course of action?

   • APay the ransom immediately to ensure data recovery
   • BTry to decrypt the files using a free decryption tool
   • CRestore from the offline backups and do not pay the ransom
   • DIgnore the ransomware and continue operations
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A hospital's IT team discovers that a workstation downloaded a malicious document from a phishing email. Within hours, files on the network share are encrypted with a .enc extension, and a ransom note demands payment in cryptocurrency. The team also notices that the malware attempted to delete Volume Shadow Copies. Which stage of the ransomware attack lifecycle is the deletion of shadow copies part of, and why?

   • ACommand and control stage; the deletion is a command received from the C2 server.
   • BImpact stage; deleting shadow copies removes a common recovery mechanism, increasing the pressure to pay the ransom.
   • CRansom demand stage; the deletion is part of displaying the ransom note to the user.
   • DInitial infection stage; deleting shadow copies is how the malware first gains a foothold.
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   A security analyst is investigating a host that is suspected of C2 communication. The analyst sees that the host is making HTTPS connections to a website that hosts a blog. The traffic is encrypted, and the analyst cannot see the content. Which technique could the attacker be using to hide C2 traffic in plain sight?

   • AUsing a VPN to encrypt all traffic
   • BUsing a proxy server to hide the destination
   • CUsing a legitimate web service (e.g., a blog) as a cover for C2 communication
   • DUsing a custom encryption protocol on a non-standard port
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An incident responder is analyzing a host that is suspected of being part of a botnet. The host is making DNS queries to a domain that changes every hour. The domain names are random and do not appear in any threat intelligence feed. Which technique is the malware likely using, and what is the best way to disrupt it?

   • ADNS tunneling; the best disruption is to block all DNS queries to external servers.
   • BHTTP beaconing; the best disruption is to block the specific URL patterns.
   • CFast flux; the best disruption is to block the IP addresses associated with the domains.
   • DDomain generation algorithm (DGA); the best disruption is to sinkhole the domains by predicting and blocking them.
   Reveal Solution Discussion Select an answer first