1.3 Describe Security Terms 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is analyzing a new ransomware sample. The analyst has already performed static analysis and identified that the malware uses a custom encryption algorithm. The analyst needs to understand the encryption algorithm to potentially develop a decryption tool. The malware is known to be packed, and the analyst has limited time. Which approach is the most efficient?

   • ASubmit the malware to an automated analysis service and wait for the report.
   • BRun the malware in a sandbox and capture the encryption keys from memory.
   • CUse a debugger to unpack the malware and then reverse engineer the encryption algorithm.
   • DSearch the internet for the malware's hash to find a known decryption tool.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which method is commonly used in static malware analysis?

   • ARunning the malware in a controlled sandbox environment
   • BObserving changes to the file system during execution
   • CExamining the malware's code without executing it
   • DMonitoring network traffic generated by the malware
   Reveal Solution Discussion Select an answer first
4. 18application · hard

   A network monitoring system tracks the number of login failures per minute on a critical server. The system uses a sliding window anomaly detection algorithm with a window size of 10 minutes. Under normal conditions, the server experiences an average of 2 login failures per minute. At 10:00, an attacker begins a brute-force attack, causing a spike to 20 failures per minute. The anomaly detection system alerts when the average in the window exceeds 5 failures per minute. At what time will the system first trigger an alert, assuming the attack continues?

   • AAt 10:10, when the entire window consists of elevated data.
   • BAt 10:01, after one minute of elevated failures.
   • CAt 10:05, when the window contains enough elevated data to push the average above 5.
   • DAt 10:00, immediately when the spike begins.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC team has a well-defined incident response plan for ransomware incidents. The plan includes steps such as isolating affected hosts, collecting forensic evidence, and notifying management. However, the team often takes too long to execute these steps because they are done manually. The team wants to reduce the time to contain ransomware outbreaks. Which solution is the most effective?

   • AIncrease the alert severity threshold for ransomware so that only critical incidents trigger a response.
   • BTrain all analysts on the incident response plan and conduct regular drills.
   • CImplement run book automation that automatically isolates affected hosts and collects predefined forensic data when a ransomware alert is triggered.
   • DUse threat intelligence to block known ransomware command-and-control domains.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does sliding window anomaly detection identify deviations in time-series data?

   • ABy comparing each new data point to a fixed threshold that never changes
   • BBy using machine learning to predict future attacks
   • CBy analyzing the entire historical dataset from the beginning of time
   • DBy comparing new data points to a baseline calculated from a moving window of recent data
   Reveal Solution Discussion Select an answer first