1.3 Describe Security Terms 200-201 Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A security operations center (SOC) monitors a web server's request rate. The normal baseline is 100 requests per minute with a standard deviation of 10. The SOC uses a sliding window anomaly detection algorithm with a window size of 5 minutes and alerts when the average request rate in the window exceeds 120 requests per minute. At 14:00, a distributed denial-of-service (DDoS) attack begins, causing the request rate to jump to 300 requests per minute and remain constant. The SOC wants to minimize false positives while detecting the attack as quickly as possible. Which configuration change would detect the attack faster without significantly increasing false positives?

   • AUse a weighted sliding window that gives more weight to recent data points.
   • BIncrease the alert threshold to 150 requests per minute.
   • CKeep the window size the same but alert on any single minute that exceeds 120 requests.
   • DReduce the sliding window size to 1 minute.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security engineer is analyzing a custom binary that is suspected of containing a backdoor. The engineer needs to understand the binary's control flow and identify the specific function that handles authentication bypass. Which reverse engineering technique is most appropriate for this task?

   • APerform a hash lookup of the binary on VirusTotal to see if it is known malware.
   • BRun the binary in a debugger and set breakpoints on authentication-related functions.
   • CExecute the binary in a sandbox and record its network traffic.
   • DUse a disassembler to convert the binary into assembly code and trace the call graph to locate the authentication function.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A large e-commerce company is transitioning to a DevSecOps model. The security team wants to integrate security into the CI/CD pipeline without slowing down the release process. The company currently releases updates twice a week. The security team has proposed the following measures: (1) automated static application security testing (SAST) in the build stage, (2) dynamic application security testing (DAST) in the staging environment, and (3) a manual security review before each production release. The development team is concerned that the manual review will cause delays. Which approach best aligns with DevSecOps while addressing the development team's concern?

   • AReplace SAST and DAST with the manual security review to ensure thorough analysis.
   • BPerform the manual security review after the production release to avoid delays.
   • CKeep the manual security review but limit it to high-risk changes, and use automated SAST and DAST for all other changes.
   • DRemove the manual security review and rely solely on automated SAST and DAST.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A malware analyst is analyzing a sample that appears to be a dropper for a second-stage payload. The analyst has limited time and needs to quickly determine the C2 infrastructure and the payload's capabilities. The sample is obfuscated and uses a custom packer. Which approach is most time-efficient?

   • APerform full reverse engineering of the packer to understand the unpacking algorithm, then analyze the unpacked code.
   • BSubmit the sample to a public malware analysis service and wait for the report.
   • CRun the sample in a sandbox with network monitoring to capture C2 traffic and any dropped files, then analyze the dropped payload.
   • DUse a strings extraction tool on the packed binary to find C2 domains.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A malware analyst receives a suspicious executable that was found on a compromised workstation. The analyst needs to determine the malware's command-and-control (C2) server address and the specific system commands it executes. Which combination of analysis methods would be most effective?

   • ARun the executable in a sandbox and observe network connections, then use static analysis to extract embedded strings and API calls.
   • BExecute the malware directly on the compromised workstation to see what it does in the real environment.
   • COnly perform static analysis by disassembling the binary to read the source code, avoiding execution to prevent infection.
   • DSubmit the executable to an online multi-scanner and rely on the detection ratio to infer its capabilities.
   Reveal Solution Discussion Select an answer first