5.2 Detect, Analyze, and Mitigate Malware Incidents CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security operations team is evaluating a new malware detection tool. The tool uses a combination of signature-based, behavioral, and heuristic analysis. During a proof-of-concept, the tool failed to detect a known malware sample that was packed with a custom packer. Which detection technique is most likely to have failed?

   • ASignature-based detection because the packed sample's signature is different from the original
   • BAll techniques failed because the packer evades all detection
   • CBehavioral analysis because the malware did not exhibit malicious behavior in the sandbox
   • DHeuristic analysis because the packer is not recognized as suspicious
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst has captured a suspicious executable from an infected host. The analyst needs to quickly determine if this file is related to a known malware family and identify its command-and-control (C2) server. The analyst has limited time and cannot risk executing the file on a production system. Which analysis method should the analyst use first?

   • ADisassemble the file using a debugger to step through its code
   • BSubmit the file to a public malware analysis service for automated dynamic analysis
   • CRun the file in a sandbox to observe its behavior and network connections
   • DPerform static analysis by examining the file's strings, imports, and hashes
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company has confirmed a ransomware outbreak on several workstations in the finance department. The malware is encrypting files and spreading to network shares. The incident response team has been activated. What should be the immediate next step in the incident response process?

   • ANotify law enforcement and regulatory bodies about the incident
   • BIdentify the malware family and gather IOCs for threat intelligence
   • CRestore the encrypted files from backups
   • DIsolate the affected workstations from the network to prevent further spread
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital network has experienced a malware infection that spread rapidly from an infected laptop to multiple servers via the internal network. The IT security team wants to implement a mitigation strategy to prevent such lateral movement in the future. Which strategy would be most effective?

   • AIncrease the frequency of antivirus signature updates
   • BEnforce strict access controls by implementing least privilege on all user accounts
   • CDeploy endpoint protection software on all servers and workstations
   • DImplement network segmentation to separate sensitive departments and restrict traffic between them
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is evaluating how to improve their malware detection capabilities. They currently rely solely on signature-based antivirus. They want to incorporate threat intelligence feeds to detect emerging threats. Which approach would best integrate threat intelligence into their existing detection infrastructure?

   • AReplace antivirus with a next-generation firewall that includes threat intelligence
   • BSubscribe to a threat intelligence feed and automatically update intrusion prevention system (IPS) signatures
   • CManually review threat intelligence reports and update firewall rules accordingly
   • DUse threat intelligence to create custom YARA rules for endpoint scanning
   Reveal Solution Discussion Select an answer first