6.6 Recognize Patterns Such as an Enterprise-Wide File Infection Process to Determine the Root Cause or Source of the Infection CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team notices that a file-encrypting malware has affected all hosts in the finance department but none in other departments. The first encrypted file on each finance host was created by a process that ran under the same service account. What is the most likely explanation?

   • AThe service account was compromised and used to deploy the malware to all finance hosts.
   • BThe finance department uses a different operating system that is more vulnerable.
   • CThe malware spread via a USB drive that was used only in the finance department.
   • DThe malware was delivered via a phishing email that only finance users received.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst sees that a file-encrypting malware has affected hosts in two separate office locations. In each location, the first infected host received a phishing email with the same attachment. What does this pattern suggest about the root cause?

   • AThe infection was caused by two separate phishing campaigns with different attachments.
   • BThe infection spread from a vulnerable internet-facing service in each location.
   • CThe infection originated from a single compromised host that spread via network shares.
   • DThe infection was initiated by the same phishing campaign, with the email attachment as the initial vector.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When performing root cause analysis for an enterprise-wide file infection, what is the primary goal?

   • AList all files that were modified or encrypted during the incident
   • BDetermine which security controls failed to prevent the infection
   • CIdentify the initial source of the infection, such as a compromised host or malicious email attachment
   • DEstimate the financial impact of the infection on the organization
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are investigating a file-encrypting malware that started on a single host and spread to others. Telemetry shows that the first encrypted file on the patient-zero host was created by a process that was launched from an Office application. What is the most likely initial infection vector?

   • AA brute-force attack on the user's password.
   • BA malicious macro in a document opened by the user.
   • CA malicious screensaver downloaded from the internet.
   • DA vulnerability in the operating system that was exploited remotely.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A Falcon Hunter is reviewing a Falcon search that shows a large number of hosts with recently modified executable files, all with similar encryption patterns. Which pattern is most characteristic of an enterprise-wide file infection?

   • AA single host showing a one-time modification of a system file
   • BMultiple hosts showing similar file modifications or encryption within a short time window
   • CA few hosts showing unrelated file changes over a long period
   • DOne host with a new scheduled task that runs daily
   Reveal Solution Discussion Select an answer first