5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How do threat intelligence feeds enhance malware detection?

   • ABy providing up-to-date indicators of compromise (IOCs) such as malicious IPs, domains, and hashes
   • BBy replacing the need for antivirus software
   • CBy automatically patching vulnerabilities in the operating system
   • DBy encrypting all network traffic
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security operations center (SOC) analyst notices a spike in outbound DNS queries to a domain that was recently added to a threat intelligence feed as a known C2 infrastructure. The endpoint protection platform has not flagged any files, and no signature matches have occurred. The analyst needs to determine if any host is communicating with this domain. Which approach should the analyst use to detect the malicious activity?

   • ASubmit the domain to a public sandbox for detonation to see what malware it delivers
   • BEnable behavioral analysis on the endpoint protection platform to monitor for anomalous process behavior
   • CQuery the DNS logs for any internal host that resolved the domain and correlate with proxy logs for subsequent connections
   • DUse the threat intelligence feed to create a custom signature for the domain and deploy it to the network intrusion prevention system
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A malware analyst is examining a suspicious binary. The analyst wants to understand what the malware does when executed, including any network communications and file system changes. Which analysis method should the analyst use?

   • ADynamic analysis by executing the binary in a controlled sandbox environment
   • BStatic analysis using a disassembler to review the code
   • CHash calculation to compare with known malware samples
   • DString extraction to look for URLs and IP addresses
   Reveal Solution Discussion Select an answer first
5. 19application · medium · select all that apply

   A malware incident has been detected on a critical server. The incident response team is following the incident response process. Select all the steps that are part of the containment and eradication phase.

   • AIdentify the malware family and gather IOCs
   • BIsolate the affected server from the network
   • CRemove the malware from the affected systems
   • DPatch vulnerabilities that were exploited by the malware
   • ERestore systems from clean backups
   Check answers Discussion Select an answer first
6. 20application · medium

   A company wants to reduce the impact of a potential malware infection on its critical systems. They have a flat network with no segmentation. Which mitigation strategy would be most effective in limiting the blast radius of a malware outbreak?

   • AIncrease logging and monitoring to detect malware faster
   • BDisable all unnecessary services and ports on critical systems
   • CDeploy endpoint protection on all systems
   • DImplement network segmentation to separate critical systems from the rest of the network
   Reveal Solution Discussion Select an answer first