3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which analysis technique is most useful for identifying a previously unknown malware binary on an endpoint?

   • AReviewing the system's event logs for login failures
   • BStatic analysis of the binary's code and structure
   • CComparing file hashes against a known-good database
   • DChecking the browser's download history
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an incident, a security analyst finds that a user's laptop has a Trojan, and the same user's smartphone has an app that communicates with the same external IP address. What should the analyst do to build a comprehensive picture of the intrusion?

   • AFocus only on the laptop because it is the primary work device
   • BIsolate the smartphone but continue analyzing the laptop
   • CWipe both devices immediately to prevent further spread
   • DCorrelate the indicators from both devices to identify shared command-and-control infrastructure
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which method is appropriate for preserving evidence from a mobile device that is powered on?

   • APowering the device off immediately to prevent data changes
   • BPlacing the device in a Faraday bag to isolate it from network communications
   • CRemoving the SIM card and battery to disable the device
   • DConnecting the device to a computer to create a full disk image
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After investigating a phishing incident that compromised several employee laptops, the security team has identified the malware and its entry point. What should be included in the final report to guide remediation?

   • AA recommendation to reimage all laptops without further analysis
   • BA detailed log of every keystroke made by the analyst during the investigation
   • CA list of affected hosts, indicators of compromise, and recommended containment steps
   • DOnly the malware hash and the phishing email subject
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which source of information is most useful for correlating an intrusion across multiple endpoints?

   • AThe personal notes of the system administrator
   • BLocal browser history on each endpoint
   • CIndividual endpoint firewall rules
   • DCentralized log aggregation system
   Reveal Solution Discussion Select an answer first