System and Network Behavior Analysis DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic analyst is investigating a Windows system and finds that a scheduled task was created that runs a PowerShell script every hour. The script is located in the user's AppData\Roaming folder. The analyst also finds that the script makes an HTTP request to an external URL. What is the most significant indicator that this scheduled task is malicious?

   • AThe script is written in PowerShell
   • BThe script makes an HTTP request
   • CThe script is located in AppData\Roaming
   • DThe scheduled task runs every hour
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is reviewing network traffic and notices that a server is making outbound connections to an IP address on port 445 (SMB) that is not part of the internal network. The server is a web server and should not be making SMB connections. What is the most likely explanation?

   • AThe server is running a legitimate SMB service
   • BThe server is being used for lateral movement to an external system
   • CThe server is performing a legitimate backup to an external location
   • DThe network capture is corrupted
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An incident responder is reconstructing the timeline of a malware infection. The responder has the following evidence: (1) a network log showing a connection to a known malicious IP at 12:00:00, (2) a file system image showing a file named 'malware.exe' created at 11:59:55, (3) a process log showing 'malware.exe' running from 11:59:58 to 12:05:00, and (4) a registry log showing a Run key added at 12:01:00 pointing to 'malware.exe'. What is the most likely sequence of events?

   • AThe malware was dropped, executed, connected to C2, and then established persistence
   • BThe malware established persistence, then was dropped, executed, and connected to C2
   • CThe malware connected to C2, then was dropped, executed, and established persistence
   • DThe malware was executed, then dropped, connected to C2, and established persistence
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic examiner is analyzing a Windows system that is suspected of being infected with a rootkit. The examiner finds that the process list does not show a known malicious process, but network traffic shows connections to a known C2 server. The examiner also finds that the registry key HKLM\SYSTEM\CurrentControlSet\Services has a new service named 'LegitService' that points to a file in the Temp folder. What is the most likely explanation for the hidden process?

   • AThe rootkit is hiding the process from the process list, and the service is the malware
   • BThe process is a legitimate system process that is not listed
   • CThe process is not running, and the network traffic is from another host
   • DThe process is running under a different user account
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which network behavior is a common indicator of malware command-and-control activity?

   • AA single DNS query to a popular content delivery network
   • BRegular, periodic connections to a newly registered domain
   • CLarge file transfer to a cloud storage service
   • DAn inbound connection from a known business partner
   Reveal Solution Discussion Select an answer first