4.4 Filter Event Data and Analyze Results CCFH Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A security analyst is investigating a potential malware infection. They have identified a 'FileWrite' event to a suspicious path, but the file is not in the 'KnownMalware' list. What is the most appropriate next step?

   • AAdd the file hash to the blocklist to prevent future executions.
   • BImmediately quarantine the host to prevent further damage.
   • CIgnore the event because the file is not known malware.
   • DSearch for other events involving the same file hash to see if it has been seen elsewhere.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   An analyst is reviewing 'ProcessRollup2' events and sees a process 'rundll32.exe' with a command line that includes a path to a file in the 'AppData' folder. What is the most likely interpretation?

   • AA legitimate Windows component is loading a DLL from a standard location.
   • BThe process is a false positive and can be ignored.
   • CAn attacker is using rundll32.exe to execute a malicious DLL from a user-writable location.
   • DThe process is a normal part of a software update.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   An analyst is reviewing 'NetworkConnection' events and sees a host making connections to a known malicious IP on a non-standard port. The connections are encrypted. What is the most likely explanation?

   • AThe host is infected with malware that is using encrypted communication to evade detection.
   • BThe host is a DNS server and the connection is part of a normal query.
   • CThe host is running a legitimate application that uses a non-standard port.
   • DThe connection is a false positive and can be ignored.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is reviewing a series of 'UserAccount' events and notices a user account was created and then immediately added to the 'Domain Admins' group. What is the most likely conclusion from this pattern?

   • AThis is a false positive and can be ignored.
   • BThis is a strong indicator of a malicious backdoor account.
   • CThis is a sign of a misconfigured automation script.
   • DThis is a normal administrative task performed by IT.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a series of 'SuspiciousDNSRequest' events. They notice the requests are occurring at regular 5-minute intervals. What does this pattern suggest?

   • AThe DNS server is misconfigured.
   • BA legitimate application is checking for updates.
   • CA compromised host is beaconing to a command-and-control server.
   • DA user is manually visiting a website.
   Reveal Solution Discussion Select an answer first