System and Network Behavior Analysis DFE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An incident response team is investigating a malware infection. They have the following evidence: (1) a malicious file was created on the file system at 10:00 AM, (2) a process named 'update.exe' started at 10:02 AM, (3) the process made an outbound connection to an external IP at 10:05 AM, and (4) the process was terminated at 10:10 AM. The team needs to determine if the outbound connection was used to exfiltrate data. What is the most important evidence to review?

   • AThe amount of data sent over the outbound connection
   • BThe external IP's geolocation
   • CThe process's parent process
   • DThe size of the malicious file
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a system-level indicator of compromise that an analyst would look for during malware forensics?

   • AA spike in network bandwidth usage
   • BAn unexpected outbound connection to a foreign IP address
   • CAn unusual DNS query for a known malicious domain
   • DA newly created executable file in the Startup folder
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An analyst reviews network traffic and notices a workstation sending small, periodic HTTPS requests to a domain that has no historical presence in the organization. This pattern is most indicative of which type of activity?

   • ANormal software update checks
   • BDNS cache poisoning
   • CCommand-and-control communication
   • DUser browsing a legitimate website
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is it important to correlate system logs with network logs during a malware investigation?

   • ATo calculate the total data loss
   • BTo establish a complete picture of the infection chain
   • CTo identify which users were logged in at the time
   • DTo determine the malware's encryption algorithm
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic analyst is investigating a Windows workstation that is suspected of malware infection. The analyst observes a process named 'svchost.exe' running from C:\Users\Public\Temp and making repeated HTTPS connections to a domain that was registered three days ago. Which two system and network artifacts should the analyst prioritize for correlation?

   • AThe Windows event logs for logon events and the system uptime
   • BThe file hash of svchost.exe and the local firewall rules
   • CProcess command-line arguments and the DNS cache entries for the domain
   • DThe registry Run keys and the browser history
   Reveal Solution Discussion Select an answer first