6.7 Differentiate Testing, DevOps or General User Activity from Adversary Behavior CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which action is a common configuration management behavior in DevOps?

   • ADisabling security monitoring agents on critical servers
   • BModifying firewall rules to allow all inbound traffic
   • CPushing configuration changes to multiple servers via an automation tool
   • DCreating local admin accounts on all workstations
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Falcon Hunter is using a hunting query to identify processes that are creating scheduled tasks. The query returns a process named 'schtasks.exe' creating a task named 'SystemUpdate' on multiple servers. The task runs 'powershell.exe' with arguments that include 'Invoke-WebRequest' to download a file from an internal file share. The hunter checks the baseline and finds that the IT team uses a similar task for legitimate updates. Which observation would MOST strongly indicate adversary behavior?

   • AThe task downloads a file from an internal file share.
   • BThe task is created on multiple servers.
   • CThe 'schtasks.exe' process is running from a temporary directory instead of the system32 directory.
   • DThe task is named 'SystemUpdate' and runs 'powershell.exe'.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which behavior is typical of DevOps activity?

   • ARansomware file encryption
   • BDeployment pipeline executions
   • CPass-the-hash attacks
   • DData exfiltration to external IPs
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon Hunter is investigating a series of API calls from a service account to a cloud management plane. The calls include creating new virtual machines, modifying network security groups, and deleting snapshots. The service account is used by a DevOps team for infrastructure automation. The activity occurs during a scheduled deployment window. Which observation would MOST strongly suggest this is adversary behavior rather than DevOps activity?

   • AThe activity occurs during a scheduled deployment window.
   • BThe API calls include creating and deleting resources, which are typical of infrastructure automation.
   • CThe service account has permissions to modify network security groups.
   • DThe API calls are made from an IP address that is not in the DevOps team's known egress range.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Falcon Hunter is analyzing a hunting query that returns a list of processes spawning from a web server. The results show that a process named 'php-cgi.exe' is spawning 'cmd.exe' with arguments that include 'whoami' and 'net user'. The web server is a production system that runs a custom application. The hunter also sees a similar pattern in the staging environment where the application is tested. What should the hunter do to BEST differentiate testing activity from adversary behavior?

   • ACompare the command-line arguments and process parent-child relationships between the staging and production environments.
   • BSearch for the same command-line pattern across all servers to see if it is widespread.
   • CImmediately block the web server's outbound traffic to prevent potential data exfiltration.
   • DIsolate the production web server and treat the activity as a confirmed compromise.
   Reveal Solution Discussion Select an answer first