System and Network Behavior Analysis DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An analyst finds a suspicious process on a host and also observes corresponding outbound connections from that host to an external IP. What is the primary value of correlating these two pieces of evidence?

   • AIt identifies the malware author
   • BIt proves the malware was downloaded from the internet
   • CIt helps reconstruct the timeline and scope of the infection
   • DIt eliminates the need for further analysis
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic analyst is analyzing a Windows system and finds that a process named 'lsass.exe' is running from C:\Windows\Temp\. The process is making outbound connections to an external IP. What is the most important system behavior to investigate?

   • AThe system's uptime and last reboot time
   • BThe network connections' destination ports and protocols
   • CThe file's digital signature and version information
   • DThe process's parent process and command-line arguments
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network analyst is reviewing proxy logs and finds that a workstation is making frequent requests to a domain that is known to be a malware distribution site. The requests are all for the same URL and occur every 5 minutes. The workstation's user says they have not visited that site. What is the most likely explanation?

   • AThe user is not telling the truth
   • BThe proxy logs are incorrect
   • CA background process on the workstation is making the requests
   • DThe user's browser is infected with a browser hijacker
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing network traffic and notices a host sending large amounts of data to an external IP address using the FTP protocol on port 21. The host is a database server that normally does not use FTP. The analyst also sees that a new service named 'FTPHelper' was installed on the host. What is the most likely explanation?

   • AThe host is under a brute-force attack on the FTP service
   • BThe host is performing a legitimate backup to an external server
   • CThe host is running a vulnerable FTP server that is being exploited
   • DThe host is exfiltrating data via FTP, and the new service is the malware
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is examining a compromised Linux server. The analyst finds a new user account with UID 0, a modified /etc/ld.so.preload file, and a cron job that downloads a script from an external IP. Which system behavior indicators should be reported as the most critical for confirming rootkit activity?

   • AThe file modification times of system binaries
   • BThe number of failed login attempts
   • CThe cron job and the external IP address
   • DThe UID 0 account and the modified /etc/ld.so.preload
   Reveal Solution Discussion Select an answer first