4.4 Filter Event Data and Analyze Results CCFH Practice Questions (Page 4)

Questions 16–18

1. 16expert · medium

   A threat hunter is investigating a series of 'SuspiciousDNSRequest' events. They notice the requests are for a domain that is similar to a legitimate domain but with a typo (e.g., 'gooogle.com'). What is the most likely explanation?

   • AThe DNS server is resolving the domain incorrectly.
   • BThe user is intentionally visiting a fake website.
   • CThe host is infected with malware that is using typosquatting to communicate with a C2 server.
   • DA user has a typo in their browser's address bar.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A threat hunter is investigating a potential lateral movement. They have identified a series of 'NetworkConnection' events from host A to host B on port 445, followed by 'ProcessRollup2' events on host B. Which filter would best confirm the lateral movement?

   • AFilter for 'ProcessRollup2' events on host B where the parent process is 'svchost.exe'.
   • BCorrelate the 'NetworkConnection' events from host A with 'ProcessRollup2' events on host B that have a parent process of 'services.exe'.
   • CFilter for 'UserAccount' events on host B to see if a new user was created.
   • DFilter for 'NetworkConnection' events from host A to host B on port 445.
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   An analyst is looking at 'ProcessRollup2' events and sees a process 'powershell.exe' with a command line that includes 'IEX (New-Object Net.WebClient).DownloadString(...)'. What is the most likely interpretation?

   • AThe process is a false positive and can be ignored.
   • BA system administrator is running a routine maintenance script.
   • CThe host is downloading and executing a remote script, which is a common attack technique.
   • DThe process is a normal Windows update component.
   Reveal Solution Discussion Select an answer first