4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing a proxy log entry: 2024-05-01 10:00:00, source IP 10.1.1.50, destination IP 203.0.113.5, URL http://203.0.113.5/payload.bin. The analyst notices the URL uses the IP address instead of a domain name. Which interpretation is most accurate?

   • AThe request is to a numeric IP, which may indicate an attempt to bypass DNS-based filtering.
   • BThe URL indicates the request is using HTTPS on port 443.
   • CThe destination IP is the client and the source IP is the server.
   • DThe destination port is 445 because the URL contains an IP address.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An alert shows that a process named 'svchost.exe' in a user's AppData\Roaming folder created a file called 'update.exe' and then modified the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The file hash of 'update.exe' matches a known malware signature. Which artifact element is the strongest indicator that this is malicious persistence?

   • AThe file path in AppData\Roaming
   • BThe process name 'svchost.exe'
   • CThe registry key modification
   • DThe file hash matching known malware
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing an endpoint detection and response (EDR) alert for a process that made the following system API calls: CreateFile on C:\Users\Public\payload.exe, WriteFile, and then CreateProcess on the same file. Which conclusion is best supported by these API calls?

   • AThe process is reading a configuration file and then exiting.
   • BThe process is dropping a file to disk and then executing it.
   • CThe process is deleting a file and then cleaning up.
   • DThe process is downloading a file from the internet and saving it.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   An analyst is examining a proxy log entry: GET http://www.example.com/update.php?id=123 HTTP/1.1 with a Host header of www.example.com. The analyst notices that the domain 'example.com' is a known malicious domain. Which part of the URL is the most direct indicator of compromise?

   • AThe query string id=123
   • BThe HTTP method GET
   • CThe domain example.com
   • DThe path /update.php
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An analyst is reviewing an alert where the source IP is a public address and the destination IP is a private address. What does this pairing typically indicate?

   • AAn external host is communicating with an internal host.
   • BAn internal host is communicating with an external host.
   • CTwo internal hosts are communicating on the same subnet.
   • DA DNS server is resolving a domain for an internal client.
   Reveal Solution Discussion Select an answer first