System and Network Behavior Analysis DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network analyst is reviewing proxy logs and sees that a workstation has been making requests to a URL that contains a long string of hexadecimal characters, and the responses are also hexadecimal. The workstation is also running a process that is not in the company's approved software list. What is the most likely explanation for this traffic?

   • AThe workstation is using HTTP tunneling to communicate with a C2 server
   • BThe workstation is downloading a legitimate software update
   • CThe workstation is browsing a website with dynamic content
   • DThe workstation is performing a web search
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A forensic examiner is analyzing a Windows system and finds that the file C:\Windows\System32\drivers\etc\hosts has been modified to redirect several legitimate domains to 127.0.0.1. The examiner also finds a process named 'sysmon.exe' running from a non-standard location. What is the most likely purpose of the hosts file modification?

   • ATo create a backup of the original hosts file
   • BTo enable offline access to web applications
   • CTo speed up DNS resolution for frequently visited sites
   • DTo block access to security and antivirus update domains
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network analyst observes a workstation making DNS queries for a domain that was only registered 24 hours ago. The workstation also maintains a persistent TCP connection to an IP address in a country where the company has no business operations. What should the analyst do next to confirm whether this is malicious C2 activity?

   • ABlock the domain and IP address at the firewall immediately
   • BCheck the workstation's process list and running services for an unknown process
   • CDisconnect the workstation from the network to prevent further communication
   • DReview the DNS query logs to see if other workstations queried the same domain
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident responder is reconstructing the timeline of a malware infection. The responder has a packet capture showing an outbound connection to a known malicious IP at 02:15 UTC, and a file system image showing a suspicious executable created at 02:10 UTC on the same machine. What additional evidence would best confirm that the executable initiated the network connection?

   • AProcess creation events showing the executable was running at 02:15 UTC
   • BThe presence of the executable in the user's Downloads folder
   • CThe file's SHA-256 hash matching a known malware sample
   • DThe file's creation time being before the network connection
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An incident response team is investigating a ransomware infection. They have the following evidence: (1) a process named 'encrypt.exe' was created at 10:00 AM, (2) the process accessed a large number of files on the file system between 10:00 and 10:30 AM, (3) the process made an outbound connection to an external IP at 10:05 AM, and (4) the process terminated at 10:30 AM. The team needs to determine if the outbound connection was used to exfiltrate data before encryption. What is the most important evidence to review?

   • AThe process's parent process
   • BThe external IP's reputation
   • CThe process's command-line arguments
   • DThe file access logs to see which files were accessed before the connection
   Reveal Solution Discussion Select an answer first