System and Network Behavior Analysis DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an investigation, an analyst finds that a malware sample creates a file named 'payload.dll' in the Windows Temp folder and then modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run to point to that file. The analyst also observes outbound connections to an IP address on port 445. What is the most likely purpose of the registry modification?

   • ATo disable Windows Defender and avoid detection
   • BTo establish persistence so the malware runs at every user logon
   • CTo store the malware's configuration data
   • DTo configure the malware as a network service
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An incident responder is analyzing a host that is suspected of communicating with a C2 server. The responder has the following observations: (1) the host makes a DNS query for 'update.example.com' every 5 minutes, (2) the host also makes an HTTPS connection to 'update.example.com' immediately after each DNS query, (3) the host has a process named 'svchost.exe' running from a temp directory. The responder needs to determine if the host is compromised. Which additional evidence would be most useful to confirm the C2 communication?

   • AThe process creation time of 'svchost.exe'
   • BThe file hash of 'svchost.exe'
   • CThe DNS server logs showing the IP address that resolved for 'update.example.com'
   • DA packet capture showing the content of the HTTPS connections to 'update.example.com'
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic analyst is investigating a server that is suspected of being part of a botnet. The analyst finds the following: (1) a process named 'system.exe' running from C:\Windows\Temp, (2) the process is making many outbound connections to different IP addresses on port 80, (3) the process has a low CPU usage but high network activity. The analyst also finds that the server's hosts file has been modified to block access to security vendor websites. What is the most likely purpose of the hosts file modification?

   • ATo improve network performance by caching DNS resolutions
   • BTo redirect traffic to a local proxy for monitoring
   • CTo prevent the server from downloading security updates and alerts
   • DTo enable the server to communicate with the botnet C2 server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A forensic analyst is examining a Windows system and finds that a new service was created that runs an executable from C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\update.exe. The service is set to start automatically. The analyst also finds that the executable makes outbound connections to an external IP. What is the most significant system behavior indicator that this service is malicious?

   • AThe service was created recently
   • BThe service is set to start automatically
   • CThe executable makes outbound connections
   • DThe executable is located in the Startup folder
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a malware investigation, an analyst observes a process that repeatedly creates and deletes files in the Windows Temp directory and modifies the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. Which type of indicator is the registry modification primarily considered?

   • AA host-based indicator of compromise
   • BA network-based indicator of compromise
   • CA memory-only indicator of compromise
   • DA DNS-based indicator of compromise
   Reveal Solution Discussion Select an answer first