3.4 Identify Type of Evidence Used Based on Provided Logs 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst has confirmed from a host's process creation log that a malicious executable ran. Which additional log would provide corroborative evidence that the executable was downloaded from the internet?

   • AA DNS log showing a query for the suspicious domain
   • BA proxy log showing an HTTP GET request to a suspicious domain at the same time
   • CA firewall log showing a blocked connection to the domain
   • DAn antivirus alert for the executable
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst has best evidence that a user exfiltrated data: a proxy log showing a large upload to a personal cloud storage site. Which additional log would provide CORROBORATIVE evidence?

   • AAn application log showing the user ran a disk cleanup tool
   • BA Windows event showing the user changed their password earlier that day
   • CA Sysmon event showing the user's browser started
   • DA firewall log showing an outbound connection to the same site at the same time
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an incident, an analyst finds a PowerShell script that downloads an executable and runs it. The script's execution is logged in the Windows Event Log, and the downloaded file's hash matches a known malware sample. Which log entry is the best evidence that the script ran on the host?

   • AA network log showing a connection to the download server
   • BA user report that their computer was slow
   • CThe file hash matching a known malware sample
   • DEvent ID 4688 (Process Creation) showing powershell.exe with the script path
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A user's account shows a successful login at 02:00 from an IP address known to be a VPN exit node. No other activity is logged. What type of evidence does this login provide that the account was used by an attacker?

   • ACorroborative evidence, because it supports a theory of remote access
   • BIndirect evidence, because the login implies attacker involvement through circumstantial factors
   • CDirect evidence, because the login event is a fact
   • DBest evidence, because the login is recorded in the security log
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst has best evidence (a process creation log) that a ransomware binary executed. Which additional log would provide the strongest corroborative evidence that the ransomware was delivered via a malicious macro in a Word document?

   • AWindows Event 4688 showing winword.exe spawning powershell.exe
   • BA DNS log showing a query for a malicious domain
   • CA user's email saying they opened an attachment
   • DA file system log showing the Word document was created
   Reveal Solution Discussion Select an answer first