6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is investigating a host where a legitimate application was replaced with a malicious binary. The malicious binary runs every time the system starts. Which persistence mechanism is most likely being used, and what is the best way to confirm it?

   • AA registry Run key; check the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key
   • BA startup folder; check the Startup folder for the malicious binary
   • CA Windows service; check the service's binary path and start type
   • DA scheduled task; check the task's trigger and action
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which statement best describes an Indicator of Attack (IOA)?

   • AA file hash that matches a known malicious binary
   • BA sequence of behaviors that suggests an attacker is attempting to achieve a goal
   • CA list of compromised credentials found on the dark web
   • DA network signature that matches a known exploit payload
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a script-based persistence mechanism?

   • AAdding a user to the Remote Desktop Users group
   • BPlacing a malicious PowerShell script in the Temp folder and scheduling it to run
   • CChanging the system's default browser
   • DDisabling the Windows Update service
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary focus of an Indicator of Attack (IOA) compared to an Indicator of Compromise (IOC)?

   • ADetecting the behavioral intent and sequence of events that indicate an attack is occurring
   • BListing all known vulnerabilities in a system to prioritize patching
   • CIdentifying the specific malware family or file hash involved in an intrusion
   • DCollecting forensic evidence after a breach has been confirmed
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a common persistence mechanism?

   • AScheduled tasks
   • BScreen saver settings
   • CBrowser bookmarks
   • DDisk defragmentation
   Reveal Solution Discussion Select an answer first