6.6 Recognize Patterns Such as an Enterprise-Wide File Infection Process to Determine the Root Cause or Source of the Infection CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   In a file-encrypting malware investigation, you find that the first encrypted file on each host was created by a process that had a parent process of 'powershell.exe'. On the earliest host, the PowerShell process was started by a user who had just opened an email attachment. What is the most likely root cause?

   • AThe email attachment was a PDF that exploited a vulnerability in the PDF reader.
   • BThe email attachment was a benign document that triggered a legitimate PowerShell script.
   • CThe email attachment contained a script that was executed via PowerShell.
   • DThe PowerShell process was started by a scheduled task unrelated to the email.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are hunting for the source of a file-encrypting malware. You have identified that the malware process on each host creates a unique mutex. You also notice that the mutex name is the same on all hosts. What does this indicate?

   • AThe malware is using a different mutex on each host to avoid detection.
   • BThe mutex is a decoy to mislead analysts.
   • CThe same malware family is responsible for all infections.
   • DThe malware is a polymorphic variant that changes its mutex.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A file-encrypting malware has affected hosts in two different office locations. In location A, the first infected host received a phishing email. In location B, the first infected host was a server that had a vulnerable internet-facing service. What is the most likely root cause?

   • AThe malware spread from location A to location B via a VPN connection.
   • BThe malware was deployed by an insider who had access to both locations.
   • CThe malware was delivered via a third-party software update in both locations.
   • DThe malware used two different initial vectors: phishing in location A and service exploitation in location B.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are hunting for the source of a file-encrypting malware that has affected 50 hosts. Telemetry shows that the first encrypted file on each host was created by a process that ran under the same user account. Which query would best help you identify the initial execution time and source host?

   • ASearch for all network connections to the same external IP address, then sort by connection time.
   • BSearch for all file modifications on the first affected host, then sort by modification time.
   • CSearch for all logins by the user account, then sort by login time.
   • DSearch for all processes that created files with the .crypt extension, then sort by the earliest timestamp across all hosts.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following telemetry data is most useful for identifying the source of an infection?

   • AThe total number of files encrypted during the incident
   • BThe initial execution time, user, and process involved
   • CThe current CPU usage of all affected hosts
   • DThe list of all network shares on the domain
   Reveal Solution Discussion Select an answer first