4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is investigating an alert that shows a file downloaded from a URL. The file's MD5 hash matches a known malware signature, but the SHA-256 hash does not match any known threat. The analyst also sees that the URL is a legitimate software vendor's site. Which conclusion is most appropriate?

   • AThe SHA-256 hash is irrelevant because MD5 is the standard.
   • BThe MD5 match is suspicious, but the SHA-256 mismatch and legitimate URL suggest a possible false positive.
   • CThe file is definitely malware because the MD5 matches.
   • DThe file is definitely safe because the URL is legitimate.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC analyst is reviewing an alert that shows a workstation at 10.0.0.50 communicating with a server at 203.0.113.20. The flow shows source port 12345 and destination port 443. The analyst also sees a DNS query for 'update.example.com' resolving to 203.0.113.20. The domain is not on any threat list, but the IP is in a known malicious range. Which interpretation is most accurate?

   • AThe traffic is likely malicious because the destination IP is in a known malicious range, even though the domain is not flagged.
   • BThe traffic is a false positive because the source port is ephemeral and the destination port is 443.
   • CThe traffic is a command-and-control callback because the destination port is 443.
   • DThe traffic is benign because the domain is not on a threat list and port 443 is HTTPS.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A network analyst is reviewing an alert that shows a server at 192.168.1.10 sending a large amount of data to 203.0.113.77 on TCP port 22. The analyst also sees a DNS query for 'backup.example.com' resolving to 203.0.113.77. The domain is not on any threat list, but the volume of data is unusual for the server. Which interpretation is most accurate?

   • AThe traffic is benign because port 22 is used for secure file transfer.
   • BThe traffic is a command-and-control channel because the destination port is 22.
   • CThe traffic is a false positive because the domain is not on a threat list.
   • DThe traffic is likely data exfiltration because of the unusual volume to an external IP, even though the domain is not flagged.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an incident, an analyst examines a Windows event log entry for a process named svchost.exe. The event shows the process created a file named C:\Users\Public\update.exe and then made a call to WinExec. The file's SHA-256 hash matches a known malware signature. Which set of artifacts most strongly indicates malicious activity?

   • AThe process name svchost.exe and the file creation event alone
   • BThe SHA-256 hash match and the process name svchost.exe
   • CThe WinExec API call and the file name update.exe
   • DThe file path in a user-writable location, the WinExec API call, and the matching malware hash
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A security analyst is investigating a suspicious file downloaded from an email attachment. The analyst computes the MD5, SHA-1, and SHA-256 hashes of the file. Which statement about using these hashes for threat identification is correct?

   • AMD5 is the most reliable because it is shorter and faster to compute.
   • BSHA-256 is preferred because it is less collision-prone and widely used in threat intelligence.
   • CAll three hashes are equally reliable for identifying malware.
   • DSHA-1 is the best choice because it is faster than SHA-256 and more secure than MD5.
   Reveal Solution Discussion Select an answer first