3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is investigating a phishing email that was opened on a corporate laptop. The email contained a link to a malicious website. The analyst finds that the laptop's DNS cache shows a query for the malicious domain, but no malware was detected on the laptop. Which additional data source would best help determine if the intrusion spread to other endpoints?

   • AReview the laptop's Windows event logs for failed login attempts.
   • BCheck the laptop's browser history to see if the user visited other websites.
   • CRun a full antivirus scan on the laptop to look for other malware.
   • DReview the corporate firewall and proxy logs for connections to the malicious domain from other internal IP addresses.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which system artifact is most commonly examined to identify persistence mechanisms on a Windows desktop?

   • ADHCP lease files
   • BPowerShell history
   • CBrowser cookies
   • DRegistry run keys
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is examining a Linux server that was compromised. The analyst finds a suspicious process running from /tmp and wants to determine if it is malicious. Which analysis technique would provide the most useful evidence?

   • ACheck the server's uptime
   • BDelete the /tmp directory to remove the malware
   • CReboot the server to clear the process
   • DCheck the process's command line, open files, and network connections
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a suspected intrusion on an employee's Windows laptop. The laptop is currently powered on and the user is logged in. The analyst needs to preserve volatile data before any further action. Which step should the analyst perform first?

   • ACapture the contents of RAM using a memory acquisition tool
   • BShut down the laptop gracefully to preserve evidence
   • CCreate a forensic image of the hard drive
   • DDisconnect the laptop from the network
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a potential intrusion on a Linux server that hosts a web application. The analyst suspects that an attacker exploited a web vulnerability to upload a webshell. Which set of artifacts should the analyst examine to confirm the webshell and its activity?

   • AWeb server access logs, uploaded file timestamps, and shell history for the web service account.
   • BThe system's ARP cache and routing table.
   • CThe user's browser history and cookies.
   • DThe server's power supply logs and temperature sensors.
   Reveal Solution Discussion Select an answer first