3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A predictive AI system correlates the following events for a single host: (1) a brute-force attack on the host's SSH service, (2) a successful login from an unusual IP, (3) the host then makes outbound connections to multiple internal servers on port 445, and (4) the host downloads a file from a known malware distribution site. Which stage of the attack sequence does the outbound SMB connections to internal servers represent?

   • AInitial access
   • BLateral movement
   • CCommand and control
   • DExfiltration
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A predictive AI system flags a server that is sending large amounts of data to an external IP at 3 AM. The server is a database server that normally does not communicate with external IPs. The AI's anomaly score is high, but the security team is unsure if it is a true positive. Which additional evidence would most strongly indicate that the traffic is malicious?

   • AThe server's firewall logs show that the outbound connection was initiated by a system process.
   • BThe server's administrator recently installed a monitoring agent that sends telemetry to a cloud service.
   • CThe external IP is associated with a known cybercrime forum.
   • DThe server is part of a cluster that performs nightly batch jobs.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst reviews a predictive AI dashboard that flags a sequence of events: (1) an internal host performs a large number of DNS queries for random subdomains of a known malware domain, (2) the host then establishes a TLS connection to an external IP on port 443, and (3) the host begins sending small, periodic encrypted payloads to that same IP. The analyst needs to map these events to the attack lifecycle to prioritize the response. Which stage does the AI output most clearly indicate is currently active?

   • AExploitation
   • BReconnaissance
   • CCommand and control (C2)
   • DExfiltration
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement best describes how predictive AI helps in interpreting an attack sequence?

   • AIt blocks all traffic from unknown sources
   • BIt provides a list of all IP addresses that have ever communicated with the network
   • CIt correlates individual alerts into a coherent timeline of attack stages
   • DIt automatically patches vulnerabilities as they are detected
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident, a predictive AI tool reconstructs the following sequence: (1) an external IP performs a port scan of the company's DMZ, (2) a web server sends an outbound connection to that IP on port 4444, (3) the web server then begins communicating with an internal database server on a non-standard port. The incident response team must prioritize actions. Which action should be taken first?

   • AIsolate the web server from the network
   • BRun a vulnerability scan on the web server
   • CBlock the external IP at the firewall
   • DDisconnect the database server
   Reveal Solution Discussion Select an answer first