3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which remediation step is most appropriate after confirming that a specific malware binary was found on an endpoint?

   • AQuarantine the endpoint and remove the malware
   • BChange all user passwords without addressing the malware
   • CIgnore the finding if the malware is not actively running
   • DReimage the entire network without further analysis
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an investigation of a Windows laptop, the analyst finds a suspicious PowerShell script in the user's Downloads folder. The script contains a command that downloads an executable from an external IP and runs it. Which analysis technique would best confirm whether the executable executed and what it did?

   • ACheck the browser history to see if the user visited the external IP address.
   • BReview the Windows Prefetch files and the Security event log for process creation events.
   • CRun the script in a sandbox to observe its behavior.
   • DSearch the filesystem for any file with the .exe extension in the Downloads folder.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is investigating a potential intrusion that involved a phishing email sent to multiple users. The analyst finds that one user clicked the link and entered credentials on a fake login page. The analyst also finds that the same credentials were used to log into the corporate VPN from an external IP. Which conclusion is most supported by the evidence?

   • AThe attacker used the phished credentials to gain VPN access, and the user's account is compromised.
   • BThe phishing email was a test from the security team, and the VPN login is unrelated.
   • CThe VPN login was performed by the user from a different location, and no compromise occurred.
   • DThe user's credentials were not compromised because the VPN login was from a legitimate remote worker.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is investigating a potential intrusion on a Windows server that runs a critical application. The analyst has limited time because the server must be restored to service quickly. The analyst finds a suspicious scheduled task that runs a PowerShell script. Which action best balances the need for evidence preservation and business continuity?

   • AImmediately power off the server and perform a full forensic image of the hard drive.
   • BRun the PowerShell script in a sandbox to understand its behavior, then reimage the server.
   • CDelete the scheduled task and the PowerShell script, then reboot the server.
   • DCapture a memory dump and copy the scheduled task and PowerShell script to an external drive, then disable the task and restore the server to service.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is examining a Windows workstation suspected of malware infection. The analyst finds a suspicious executable in the user's AppData folder and wants to determine if it has persistence mechanisms. Which analysis technique would be most effective?

   • AHash the executable and compare to a known-good database
   • BReview the browser history for malicious URLs
   • CCheck the Windows Registry for Run keys and scheduled tasks
   • DAnalyze network traffic for command-and-control communication
   Reveal Solution Discussion Select an answer first