4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   An analyst sees an alert with the following flow: 10.0.0.5:12345 -> 172.16.0.10:22. The analyst knows 10.0.0.5 is a user workstation and 172.16.0.10 is an internal server. Which interpretation is most accurate?

   • AThe server is attempting an SSH connection to the workstation.
   • BThe server is running an SSH client on port 22.
   • CThe workstation is running an SSH server on port 12345.
   • DThe workstation is attempting an SSH connection to the server.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   An event log shows a process creating a registry key under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. What is the most likely purpose of this action?

   • ATo establish a network connection.
   • BTo achieve persistence by launching a program at system startup.
   • CTo disable Windows Defender.
   • DTo update the system time.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is reviewing an alert from a web proxy. The log shows a request to http://192.0.2.5/update.php?file=../../etc/passwd. The source IP is an internal workstation, and the destination port is 80. Which interpretation is most accurate?

   • AThe URL contains a path traversal attempt, and the use of a raw IP may bypass domain-based filtering.
   • BThe destination port 80 indicates an HTTPS request.
   • CThe workstation is the server because it is the source IP.
   • DThe file parameter is a legitimate way to read system files.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is triaging an alert that contains a file named 'invoice.pdf.exe' with a SHA-256 hash of 5d41402abc4b2a76b9719d911017c592. The analyst queries a threat intelligence platform and finds the hash is associated with a known ransomware family. Which action is most appropriate?

   • AAllow the file because the hash is not in the local antivirus database.
   • BIgnore the alert because the file extension is .exe, not .pdf.
   • CQuarantine the file and block the hash across the environment.
   • DRun the file in a sandbox to confirm it is malicious before acting.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is reviewing an alert that contains a file downloaded from a URL. The file's MD5 hash is 44d88612fea8a8f36de82e1278abb02f, which is known to be the hash of the EICAR test file. What is the most appropriate conclusion?

   • AThe URL is malicious because it hosts the EICAR file.
   • BThe file is definitely malware and should be quarantined.
   • CThe hash is invalid because MD5 is not a secure algorithm.
   • DThe file is a benign test file, but the download may still be suspicious.
   Reveal Solution Discussion Select an answer first