4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An alert contains a file named invoice.exe with a SHA-256 hash that does not match any known malware. The analyst also sees a registry key created under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which action is most appropriate?

   • AClose the alert because the hash is not known malware.
   • BTreat the registry persistence mechanism as a suspicious artifact and investigate further.
   • CIgnore the registry key because Run keys are always legitimate.
   • DDelete the registry key immediately to remediate the threat.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing an alert triggered by a workstation that contacted an external IP on TCP port 445. The alert shows the workstation's IP as the source and the external IP as the destination. The analyst also sees a URI in the event data: http://192.0.2.10/update. Which conclusion is best supported by these artifacts?

   • AThe workstation initiated an SMB connection to the external IP, and the URI suggests a separate HTTP request to the same IP.
   • BThe external IP initiated an SMB connection to the workstation, and the URI is the file share path.
   • CThe workstation is running an SMB server, and the URI is the network path to the shared folder.
   • DThe external IP is the client and the workstation is the server, with the URI representing a web request to the workstation.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An analyst has a file hash of a suspicious executable. Which action is most appropriate to determine if the file is known malware?

   • ALook up the file name in the Windows registry.
   • BCheck the file's digital signature.
   • CRun the executable in a sandbox to observe its behavior.
   • DCompare the hash against a threat intelligence feed or malware database.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is reviewing a web proxy log entry: GET http://cdn.example-cdn.com/scripts/analytics.js HTTP/1.1 with a Referer header of http://www.example-bank.com/login. The analyst notices that the domain 'example-cdn.com' is a known content delivery network, but the IP address resolved for the domain is 203.0.113.45, which is flagged as malicious in threat intelligence. The bank's website is legitimate. Which interpretation is most accurate?

   • AThe request is malicious because the resolved IP is flagged, indicating the CDN domain may be compromised or the DNS is poisoned.
   • BThe request is benign because the domain is a known CDN and the referer is a legitimate bank.
   • CThe request is a command-and-control callback because the IP is flagged.
   • DThe request is a phishing attempt because the referer is a bank.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An endpoint alert shows a process named wscript.exe making a call to ShellExecute with the parameter 'powershell -enc ...'. Which action is the process performing?

   • AExecuting a PowerShell command via a Windows scripting host
   • BCreating a new file on disk
   • CEstablishing a network connection
   • DWriting to the Windows registry
   Reveal Solution Discussion Select an answer first