Malicious Activity Indicators CS0-003 Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   An employee receives an email that appears to be from the company's IT department, stating that their password has expired and they must click a link to renew it immediately. The link points to a URL that closely resembles the company's official domain but is slightly misspelled. Which of the following is the BEST immediate action for the employee to take?

   • AClick the link and enter their credentials to avoid account lockout
   • BReply to the email to ask for verification
   • CForward the email to all employees to warn them
   • DReport the email to the security team and delete it
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing network traffic logs and notices a series of DNS queries for a domain that is known to be malicious. The queries are coming from a single internal IP address. Which of the following is the MOST likely explanation for this activity?

   • AThe DNS server is misconfigured and is resolving the domain incorrectly
   • BA user is conducting a security research project
   • CA user is accidentally typing the malicious domain into their browser
   • DA host on the network is infected with malware that is communicating with a command-and-control (C2) server
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is reviewing a report of a successful phishing attack. The attacker sent an email to a group of employees, and one employee clicked the link and entered their credentials. The analyst needs to determine the scope of the attack. Which of the following is the MOST important information to gather first?

   • AThe IP address of the attacker
   • BThe credentials that were entered by the employee
   • CThe employee's account activity since the phishing attack
   • DThe list of employees who received the email
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been transferred from a database server to an external IP address via the File Transfer Protocol (FTP). The database server is not supposed to have any FTP client software installed. Which of the following is the BEST evidence that this activity is malicious?

   • AThe external IP address is in a different country
   • BThe FTP traffic is encrypted
   • CThe database server has no legitimate reason to initiate FTP connections
   • DThe data transfer occurred during business hours
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is investigating a host that is suspected of being compromised. The analyst finds a new service running on the host that is not part of any approved software. The service is configured to start automatically. The analyst also notices that the host is communicating with an external IP address on a non-standard port. Which of the following is the BEST course of action to confirm the host is compromised?

   • AImmediately disconnect the host from the network
   • BAnalyze the service's executable file and its network connections
   • CReboot the host to see if the service stops running
   • DCheck the host's firewall logs to see if the service is allowed
   Reveal Solution Discussion Select an answer first