6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An incident response team is responding to a breach where the attacker has established persistence via a scheduled task and a rogue service. The team needs to eradicate the threat while minimizing business disruption. Which approach is most appropriate?

   • ALeave the scheduled task and service in place and monitor for further activity
   • BReboot the host first, then delete the scheduled task and service
   • CDisable the scheduled task and service, then verify no other persistence mechanisms exist before removing them
   • DDelete the scheduled task and service immediately, then reboot the host
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst reviews Falcon alerts and sees a single process spawning multiple child processes, each attempting to authenticate to different internal hosts using stolen credentials. No known malicious file hashes are detected. Which statement best describes why this activity is classified as an IOA rather than an IOC?

   • AThe activity is considered an IOA because it involves multiple hosts, which is a defining characteristic.
   • BThe activity is based on observed behavior and the sequence of events, not just a static indicator.
   • CThe activity is an IOA because it uses stolen credentials, which are always classified as IOAs.
   • DThe activity is detected because the process names match a known threat actor's toolset.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does behavioral analytics contribute to IOA detection?

   • ABy scanning for open ports on a network
   • BBy establishing a baseline of normal activity and flagging deviations
   • CBy comparing file hashes against a known malware database
   • DBy blocking all traffic from known malicious IP addresses
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   An analyst observes a process writing a PowerShell script to the current user's Startup folder and then creating a scheduled task that runs the same script every hour. Which two persistence mechanisms are being used?

   • ARegistry Run key and Windows service
   • BStartup folder and scheduled task
   • CStartup folder and registry Run key
   • DScheduled task and kernel driver
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a kernel driver persistence mechanism?

   • ACreating a scheduled task that runs daily
   • BAdding a registry Run key
   • CModifying the hosts file
   • DLoading a malicious driver that runs at boot time
   Reveal Solution Discussion Select an answer first