4.9 Interpret Common Artifact Elements from an Event to Identify an Alert 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   An analyst is investigating an alert on a Linux server. The event log shows that a process named 'nginx' created a file in /tmp named 'x' and then made a call to execve with the argument '/bin/sh'. The file's SHA-256 hash is not in any threat feed. Which conclusion is best supported?

   • AThe unknown hash proves the file is safe.
   • BThe nginx process is performing normal web server operations.
   • CThe nginx process may be compromised, as creating a file in /tmp and executing a shell is suspicious.
   • DThe execve call is a normal API for nginx to serve web pages.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During an alert investigation, an analyst finds a file named 'svchost.exe' in the user's Startup folder. Why is this file considered suspicious?

   • AThe file name 'svchost.exe' is always malicious.
   • BThe legitimate svchost.exe is normally located in C:\Windows\System32, not the Startup folder.
   • CThe Startup folder is a legitimate location for system processes.
   • DThe file is too large to be a legitimate system process.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An EDR alert shows a process 'rundll32.exe' calling the API 'WinExec' with the command 'cmd.exe /c net user hacker P@ssw0rd /add'. Which conclusion is best supported by this API call?

   • AThe process is downloading a file from the internet.
   • BThe process is creating a new local user account.
   • CThe process is modifying a registry key.
   • DThe process is deleting a system file.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is investigating a beaconing alert. The flow shows a workstation sending periodic HTTPS requests to an external IP on port 443. The analyst also sees a file on the workstation with a SHA-256 hash that matches a known remote access trojan. Which conclusion is best supported?

   • AThe hash match is irrelevant because the traffic is encrypted.
   • BThe traffic is normal because it uses HTTPS on port 443.
   • CThe external IP is the client and the workstation is the server.
   • DThe workstation is likely compromised, and the beaconing is command-and-control traffic.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An EDR alert shows a process 'winword.exe' making the following API calls: CreateFile on 'C:\Users\user\AppData\Local\Temp\macro.vbs', WriteFile, and then ShellExecute on 'macro.vbs'. The file hash of 'macro.vbs' is unknown. Which conclusion is best supported?

   • AThe activity is malicious only if the macro.vbs file is signed.
   • BThe activity is benign because the file hash is unknown.
   • CThe activity is a false positive because winword.exe is a legitimate application.
   • DThe activity is likely malicious because winword.exe is writing and executing a script from a temp folder.
   Reveal Solution Discussion Select an answer first