6.2 Identify Suspicious/malicious Activity (IOAs) and Associated Persistence Mechanisms CCCS Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   What is the role of event correlation in IOA detection?

   • ATo block malicious IP addresses at the firewall
   • BTo replace the need for human analysis entirely
   • CTo combine multiple low-level events into a higher-level alert that indicates an attack
   • DTo store logs for compliance purposes
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   How does credential dumping contribute to persistence?

   • ABy creating a scheduled task
   • BBy modifying the registry
   • CBy allowing the attacker to use stolen credentials to access the system later
   • DBy encrypting the system's files
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   Which activity is classified as a command-and-control (C2) communication IOA?

   • AA workstation making repeated connections to an external IP address on a non-standard port
   • BA user browsing a corporate website
   • CA user downloading a file from an internal file share
   • DA server sending regular encrypted updates to a known software vendor
   Reveal Solution Discussion Select an answer first