Malicious Activity Indicators CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst notices a sudden, sustained increase in outbound network traffic from a single workstation during off-hours. Which type of network anomaly does this behavior most likely indicate?

   • AData exfiltration attempt
   • BUnauthorized software installation
   • CDenial-of-service attack
   • DBandwidth spike caused by a rogue device
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Users report that a critical business application is no longer responding to requests, and the application's service has stopped. Which type of application irregularity does this describe?

   • ARogue device
   • BUnexpected communication pattern
   • CData exfiltration attempt
   • DService interruption
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is investigating an alert about a workstation that is generating a high volume of DNS queries. The queries are for random, non-existent subdomains of a legitimate domain. The workstation is also sending a small amount of data to an external IP address. Which of the following is the MOST likely explanation for this activity?

   • AThe workstation is infected with malware that is using DNS tunneling for data exfiltration
   • BThe workstation is part of a botnet that is performing a DNS amplification attack
   • CThe workstation has a misconfigured DNS client that is generating random queries
   • DThe workstation is running a legitimate application that uses DNS for load balancing
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During a network scan, an analyst discovers an unknown device with a MAC address that does not match any vendor prefix in the organization's asset inventory. Which network anomaly is this?

   • AService interruption
   • BData exfiltration
   • CRogue device
   • DBandwidth spike
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security analyst is investigating a social engineering attack. An employee received a phone call from someone claiming to be from the company's security team. The caller said there was a security incident and asked the employee to provide their username and password for verification. The employee provided the information. Which of the following is the MOST important immediate action for the analyst to take?

   • ACall the employee to ask for more details about the call
   • BBlock the phone number that the attacker used
   • CSend an email to all employees warning them about the attack
   • DReset the employee's password and revoke any active sessions
   Reveal Solution Discussion Select an answer first