5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise has a mature security operations center (SOC) that uses a commercial threat intelligence platform (TIP) to aggregate multiple feeds. The SOC is experiencing a high volume of alerts from a new feed that lists IP addresses with a low confidence score. Analysts are spending too much time investigating false positives. The SOC manager wants to reduce alert fatigue while maintaining detection of genuine threats. What should the SOC do?

   • ADisable the low-confidence feed entirely to reduce noise
   • BCreate a separate alerting rule for low-confidence indicators that only triggers when correlated with other indicators
   • CAdjust the confidence threshold in the TIP to only alert on high-confidence indicators
   • DIncrease the frequency of feed updates to get more accurate data
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is using a sandboxing solution to analyze suspicious files. The sandbox is configured to emulate a Windows 10 environment with common applications. Recently, a malware sample was submitted but the sandbox reported it as benign. However, later analysis revealed the malware only executes when it detects a specific USB drive is present. Why did the sandbox fail to detect the malware?

   • AThe sandbox was not connected to the internet
   • BThe sandbox used an outdated operating system
   • CThe malware was packed and the sandbox could not unpack it
   • DThe sandbox did not have the required USB drive emulation
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During a ransomware incident, the incident response team has isolated the affected systems and eradicated the malware. However, the team is concerned about re-infection because the initial attack vector was a phishing email that bypassed the email gateway. The team wants to implement a long-term mitigation to reduce the risk of similar incidents. Which combination of actions would be most effective?

   • AImplement network segmentation and access controls to limit lateral movement
   • BIncrease user awareness training and conduct phishing simulations
   • CEnhance endpoint detection and response (EDR) capabilities to detect and block malware
   • DDeploy email security that uses sandboxing and threat intelligence to block malicious attachments
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a malware campaign that uses a common phishing lure. The analyst has identified several IOCs, including a set of file hashes and domains. The analyst wants to determine if the campaign is related to a known threat actor group. Which approach would be most effective?

   • ASubmit the IOCs to a sandbox for detonation to observe behavior
   • BCompare the IOCs against a threat intelligence platform that includes attribution data
   • CAnalyze the malware's code to identify unique strings or patterns
   • DSearch the internet for the file hashes to see if they are publicly discussed
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   After a major malware incident, the incident response team is writing the final report. The report will be shared with executive management and the board of directors. What is the most important aspect to include in the report for this audience?

   • ADetailed technical analysis of the malware and IOCs
   • BThe names of employees who were involved in the incident
   • CA timeline of every action taken by the incident response team
   • DA high-level summary of the incident impact, response actions, and recommended investments
   Reveal Solution Discussion Select an answer first