6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an incident response, an analyst finds that a malicious DLL is loaded every time a specific user logs on. The DLL is not registered as a service and no scheduled task references it. Which persistence mechanism is most likely being used?

   • AA registry Run key in the user's HKCU hive
   • BA Windows service configured to start automatically
   • CA scheduled task triggered at logon
   • DA kernel driver loaded at boot
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to detect attackers who use legitimate administrative tools to perform malicious actions. Which detection technique is most effective for identifying this type of IOA?

   • ABlocklisting all administrative tools from running on endpoints
   • BSignature-based detection that matches known malware hashes
   • CMonitoring only for known command-and-control domains
   • DBehavioral analytics that baseline normal admin tool usage and flag deviations
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which IOA is most commonly associated with registry-based persistence?

   • AA process creating a new scheduled task
   • BA user logging in from a new geographic location
   • CA process modifying the HKEY_LOCAL_MACHINE\...\Run key
   • DA process writing a file to the Temp folder
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an account-based persistence mechanism?

   • AChanging the system hostname
   • BCreating a new local user account with administrative privileges
   • CDeleting the system event logs
   • DDisabling User Account Control (UAC)
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is evaluating a detection that flags any process that accesses the LSASS process. The team notices a high false-positive rate because legitimate applications also access LSASS for authentication. Which approach would best reduce false positives while still detecting credential theft IOAs?

   • AIncrease the alert threshold to only flag LSASS access that occurs outside business hours
   • BRefine the detection to require a sequence of events, such as LSASS access followed by an anomalous network login
   • CDisable the detection entirely to avoid alert fatigue
   • DBlock all processes from accessing LSASS except for a whitelist
   Reveal Solution Discussion Select an answer first