1.3 Describe Security Terms 200-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security researcher is analyzing a piece of custom malware that appears to use an obfuscated algorithm to generate domain names for command-and-control communication. The researcher wants to understand the algorithm so that the security team can predict future domains and block them. Which technique is most appropriate for this task?

   • ADelete the malware sample and rely on network logs to identify past domains.
   • BUse reverse engineering to disassemble the malware and analyze the domain generation algorithm.
   • CSearch the internet for known indicators of compromise associated with the malware.
   • DRun the malware in a sandbox and observe which domains it contacts.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security operations center (SOC) analyst notices that a server's outbound network traffic has a consistent pattern of small, periodic bursts every 15 minutes, but the pattern is not flagged by any existing rule. The analyst suspects a stealthy command-and-control channel that evades static detection. The SOC wants to proactively investigate this anomaly. Which approach best aligns with threat hunting and sliding window anomaly detection?

   • ACreate a static rule that alerts whenever any outbound connection occurs on port 443.
   • BDisable the server's outbound internet access until the traffic stops.
   • CUse a sliding window anomaly detection algorithm to model the expected periodic traffic and alert on deviations from that baseline.
   • DManually review the server's firewall logs from the past month to look for any unusual IP addresses.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A malware analyst is examining a binary that is suspected of being a keylogger. The analyst wants to identify the specific API calls that the malware uses to capture keystrokes and to determine if it has any anti-debugging techniques. Which approach is most appropriate?

   • ASubmit the binary to an online malware analysis service.
   • BUse a debugger to step through the code and analyze the API calls and anti-debugging checks.
   • CRun the binary in a sandbox and observe its behavior.
   • DPerform a static analysis of the binary's strings and imports.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which activity is an example of reverse engineering?

   • ARunning a malware sample in a sandbox to observe its behavior
   • BScanning a network for open ports
   • CDecompiling a binary to read its source code
   • DUpdating antivirus signatures
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's DevOps team deploys code updates multiple times a day. The security team wants to ensure that security checks are performed continuously without slowing down the deployment pipeline. Which practice best aligns with the DevSecOps philosophy?

   • ACreate a separate security team that reviews code once a week and reports issues.
   • BIntegrate automated security scanning tools into the CI/CD pipeline so that every build is checked for vulnerabilities and compliance.
   • CDeploy code first and run security tests only after the release is live.
   • DPerform a manual security review of every code change before it is deployed.
   Reveal Solution Discussion Select an answer first