4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the URL 'https://example.com/path/file.php?id=1', which part is the domain name?

   • Aid=1
   • Bhttps
   • Cexample.com
   • D/path/file.php
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An event shows a connection from a client to a server with source port 12345 and destination port 25. What service is the client attempting to use?

   • ASSH
   • BDNS
   • CSMTP
   • DHTTP
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A proxy log shows a request to http://www.example.com/scripts/conf.php?user=admin&cmd=whoami. Which part of the URL is most likely to be an indicator of malicious activity?

   • AThe path /scripts/conf.php
   • BThe domain www.example.com
   • CThe use of HTTP instead of HTTPS
   • DThe query string containing cmd=whoami
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A process is observed calling the Windows API 'WriteProcessMemory'. What action is the process performing?

   • AWriting data into the memory space of another process.
   • BWriting data to the Windows registry.
   • CWriting data to a network socket.
   • DWriting data to a file on disk.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is reviewing an alert from a DNS log. The log shows a query for 'update.example.com' from an internal host. The response resolves to an IP that is known to be malicious. The analyst also sees a file on the host with a SHA-256 hash matching a known downloader. Which conclusion is best supported?

   • AThe host likely resolved a malicious domain and may have downloaded a malicious file.
   • BThe file hash is irrelevant because the DNS query is the only indicator.
   • CThe host is the DNS server because it made a query.
   • DThe DNS query is benign because the domain name looks legitimate.
   Reveal Solution Discussion Select an answer first