6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Falcon alert shows a process running with elevated privileges, and shortly after, the same process creates a new local user account and adds it to the Administrators group. Which two IOA categories are most directly demonstrated by this sequence?

   • ACommand-and-control and lateral movement
   • BLateral movement and command-and-control
   • CPrivilege escalation and account persistence
   • DCredential theft and privilege escalation
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An attacker has gained access to a domain controller and is using a technique to extract password hashes from memory. The attacker then uses those hashes to authenticate to other systems. Which combination of IOA categories and persistence mechanism is most relevant?

   • ACommand-and-control and service persistence; the attacker installs a service
   • BPrivilege escalation and account persistence; the attacker creates a new account
   • CLateral movement and file persistence; the attacker drops a file in AppData
   • DCredential theft and lateral movement; no persistence mechanism is directly established
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A Falcon alert shows a macro-enabled Office document in the Downloads folder executing a PowerShell command that downloads a script to the AppData\Roaming folder and sets it to run at logon via a registry Run key. Which persistence mechanism is being used?

   • AFile and script persistence
   • BDriver persistence
   • CAccount persistence
   • DService persistence
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization wants to detect lateral movement that uses legitimate remote administration tools like PsExec. Which detection strategy would be most effective?

   • AMonitor for the PsExec binary name in process creation events
   • BRely solely on antivirus signatures for PsExec
   • CCorrelate service creation events on multiple hosts with the same binary hash
   • DBlock PsExec from running on all endpoints
   Reveal Solution Discussion Select an answer first
6. 30expert · hard · select all that apply

   An incident responder is investigating a host that was compromised two weeks ago. The attacker used a previously unknown exploit to gain admin rights. Which of the following findings would indicate persistence mechanisms that the attacker may have established? (Select all that apply.)

   • AA scheduled task that runs a PowerShell script every hour
   • BA recently created Windows service with a binary path in the Temp folder
   • CA new local user account with a password that never expires
   • DA browser extension that was installed by the user
   • EAn updated antivirus definition file
   Check answers Discussion Select an answer first