System and Network Behavior Analysis DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An incident responder is investigating a ransomware attack. The responder has a network log showing a connection to a file-sharing site at 03:00 UTC, and a file system image showing that many documents were encrypted at 03:05 UTC. The responder also finds a process named 'encryptor.exe' that was created at 02:55 UTC. What is the most likely sequence of events?

   • AThe file-sharing site was used to store the encryption keys
   • BThe malware downloaded a tool from the file-sharing site, then executed it to encrypt files
   • CThe malware encrypted files first, then uploaded them to the file-sharing site
   • DThe encryption was performed by a different process than the one created
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An incident responder is analyzing a malware infection on a server. The responder has a network capture showing a connection to a known malicious IP address on port 443 at 10:00:00, and a file system image showing a new file created at 09:59:55 named 'svc.exe'. The responder also finds a new service registered in the registry at 09:59:58 that points to svc.exe. What is the most likely sequence of events?

   • AThe malware was installed as a service, then connected to the C2 server
   • BThe service registration and network connection are unrelated
   • CThe file svc.exe was created after the network connection
   • DThe malware connected to the C2 server, then installed itself as a service
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network analyst is reviewing firewall logs and notices that a workstation is making outbound connections to a remote IP on port 53 (DNS) at regular intervals. The connections are not DNS queries; they are raw TCP connections to port 53. What is the most likely explanation?

   • AThe workstation is performing a legitimate DNS zone transfer
   • BThe workstation is using DNS over TCP for legitimate purposes
   • CThe workstation is tunneling data over DNS
   • DThe firewall logs are incorrect
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic team is investigating a suspected data breach. They have the following evidence: (1) a network log showing a large outbound transfer to an external IP at 02:00 UTC, (2) a file system image showing a compressed archive created at 01:55 UTC containing sensitive files, and (3) a process log showing a process named 'backup.exe' running from 01:50 to 02:05 UTC. The team also finds that the external IP is a known file-sharing service. Which conclusion is best supported by the evidence?

   • AThe archive was created by a different process and uploaded by 'backup.exe'
   • BThe process 'backup.exe' created the archive and uploaded it to the file-sharing service
   • CThe network transfer was a legitimate backup to the file-sharing service
   • DThe archive was created after the network transfer
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic analyst is examining a Windows system and finds that the registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run has a new value named 'Updater' pointing to C:\Users\Public\update.exe. The analyst also finds that the file update.exe is a known malware sample. What is the most likely reason for this registry entry?

   • ATo ensure the malware runs automatically at system startup
   • BTo disable Windows security features
   • CTo log the malware's execution times
   • DTo store the malware's configuration settings
   Reveal Solution Discussion Select an answer first