6.1 Analyze and Recognize Suspicious Overt Malicious Behaviors CCFH Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A Falcon Hunter is investigating a series of events on a network. The events show that a user's machine made a connection to a malicious domain, then downloaded a file, and then the file was executed. The file then made a connection to a different IP address. Which attack pattern does this sequence most closely align with?

   • ADrive-by compromise
   • BMalware delivery and execution
   • CCommand and control (C2)
   • DLateral movement
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Falcon Hunter observes a series of events on a server: a PowerShell script downloads an executable, the executable runs with a command line that includes ' -enc ' followed by a long base64 string, and then the process spawns a child process that makes a network connection to an IP address in a foreign country. Which attack pattern does this sequence most closely align with?

   • APayload delivery and execution using PowerShell
   • BInitial access via a malicious document
   • CLateral movement via SMB
   • DCommand and control (C2) communication
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A user runs a script that modifies several registry keys and creates a new scheduled task. The script is not signed and has never been seen before. Which analytical approach best distinguishes a benign anomaly from a potential threat?

   • AImmediately block the user's account because the script is unsigned
   • BCompare the script's behavior to known TTPs and the user's historical activity
   • CQuarantine the entire endpoint because any registry modification is malicious
   • DIgnore the activity because the script is not a known malware
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst has two alerts: Alert A shows a single failed login attempt on a user account, and Alert B shows a process creating a scheduled task and connecting to a known malicious IP address. Which alert should be prioritized for investigation?

   • AAlert A, because failed logins are always a sign of an active attack
   • BBoth alerts equally, because all alerts have the same severity
   • CNeither alert, because both are likely false positives
   • DAlert B, because it indicates a potential compromise with persistence and command and control
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which factor is most important when determining the severity of an alert for prioritization?

   • AThe time of day the alert occurred
   • BThe username associated with the alert
   • CThe potential impact on the organization and the confidence in the detection
   • DThe number of times the alert has been seen before
   Reveal Solution Discussion Select an answer first