6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which action is part of the containment phase when responding to an IOA?

   • ADeleting the malicious files
   • BRestoring the system from a backup
   • CAnalyzing the malware in a sandbox
   • DIsolating the affected system from the network
   Reveal Solution Discussion Select an answer first
2. 32expert · hard · select all that apply

   A security operations center is tuning a detection rule that flags any process that creates a scheduled task. The rule generates many false positives because legitimate software also creates scheduled tasks. Which of the following enhancements would reduce false positives while still detecting malicious scheduled task creation? (Select all that apply.)

   • AOnly flag scheduled tasks that run with SYSTEM privileges
   • BRequire that the scheduled task action runs a script from a suspicious location like AppData or Temp
   • CFlag all scheduled task creations regardless of the parent process
   • DRequire that the scheduled task creation is performed by a process that is not a known legitimate software publisher
   • ERequire that the scheduled task creation is followed by an outbound network connection to an unknown external IP
   Check answers Discussion Select an answer first
4. 33expert · hard

   An analyst notices a kernel driver that is not signed by a trusted publisher and is set to load at boot. The driver is not present in the normal driver store. Which persistence mechanism is being used, and what is the most immediate risk?

   • AScheduled task persistence; the driver is loaded by a scheduled task, and the risk is that it will be quarantined
   • BService persistence; the driver is a type of service, and the risk is that it will be detected by antivirus
   • CDriver persistence; the driver runs with kernel privileges, potentially evading security controls
   • DRegistry persistence; the driver is loaded via a Run key, and the risk is that it will be removed by a reboot
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An analyst sees an alert where a process dumps the memory of the Local Security Authority Subsystem Service (LSASS) and then uses the extracted credentials to create a new domain account. Which persistence mechanism is being established?

   • AService persistence
   • BRegistry persistence
   • CAccount persistence
   • DScheduled task persistence
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a common category of suspicious activity that IOA detection is designed to identify?

   • ACredential theft
   • BHardware failure
   • CUser password change
   • DSoftware license expiration
   Reveal Solution Discussion Select an answer first