3.7 Determine IOCs in a Sandbox Environment (includes Generating Complex Indicators) 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A sandbox report for a backdoor shows that it creates a file in the startup folder, adds a registry key to run at boot, and opens a listening port. Which IOC is most useful for detecting the backdoor on other systems?

   • AThe listening port number
   • BThe process name of the backdoor
   • CThe name of the file in the startup folder
   • DThe registry key path and value name
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During dynamic analysis in a sandbox, which activity is typically monitored to understand malware behavior?

   • AFile system changes, such as files created, modified, or deleted
   • BThe number of users logged into the host
   • CCPU temperature fluctuations
   • DThe color scheme of the operating system
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A sandbox report shows a malware sample communicating with a domain that is categorized as 'newly seen' by threat intelligence. The domain resolves to an IP that is also not on any blocklist. What should the analyst do to increase confidence that this domain is a valid IOC?

   • AIgnore the domain because it is not on any blocklist.
   • BSearch for the domain and IP in multiple threat intelligence feeds and check for associations with other known malware samples.
   • CUse the domain as a standalone IOC because it was observed in the sandbox.
   • DAdd the domain to the blocklist immediately because it is newly seen.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team needs to detect a polymorphic malware family that changes its file hash on every infection but consistently writes to the registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run' and creates a mutex named 'Global\MALX'. The team wants to minimize false positives. Which detection strategy is most effective?

   • AGenerate a YARA rule that matches the file's byte pattern regardless of the hash.
   • BCreate a rule that triggers when a process writes to that specific registry key and creates the named mutex within a 5-minute window.
   • CUse only the mutex name as the indicator because it is unique to the malware.
   • DBlock the registry key write for all processes using a host-based security policy.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is analyzing a malicious document that uses a known exploit to download a payload. The sandbox report shows the document spawns a process that makes a DNS query for a specific domain. Which sandbox feature is most useful for capturing the DNS query as an IOC?

   • ARegistry monitoring that logs all key changes
   • BProcess monitoring that tracks child processes
   • CNetwork protocol logging that records DNS requests and responses
   • DFile system monitoring that logs all file creations
   Reveal Solution Discussion Select an answer first