System and Network Behavior Analysis DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network analyst is reviewing firewall logs and sees a workstation making periodic connections to a remote server on port 443 every 60 seconds, each transferring exactly 512 bytes. The workstation also has a process named 'winupdate.exe' running from a temp directory. What should the analyst conclude from this behavior?

   • AThe workstation is part of a distributed denial-of-service attack
   • BThe workstation is likely infected with malware using a beaconing pattern
   • CThe workstation is performing a legitimate Windows update
   • DThe workstation has a misconfigured monitoring agent
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An organization discovers that a server was compromised. The server's event logs show a successful login from an external IP at 2:00 AM. The server's file system shows that a new executable was created at 2:05 AM. Network logs show that the server made an outbound connection to an external IP at 2:10 AM. The organization wants to determine if the external IP that logged in is the same as the IP the server connected to. What is the best way to correlate this evidence?

   • AReview the server's firewall logs for the outbound connection
   • BCompare the IP addresses in the event logs and network logs
   • CCheck the server's ARP cache for the MAC address of the external IP
   • DAnalyze the executable's file hash to see if it is known malware
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A forensic analyst is examining a Windows system and finds that a new DLL file was added to the system32 directory. The DLL is not signed and is not part of any known software. The analyst also finds that a process named 'explorer.exe' is loading this DLL. What is the most significant system behavior indicator that this DLL is malicious?

   • AThe DLL is located in system32
   • BThe DLL was recently created
   • CThe DLL is loaded by explorer.exe
   • DThe DLL is not digitally signed
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic analyst is examining a Windows system suspected of malware infection. The analyst finds a new registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that points to a script in the user's Downloads folder. The script is scheduled to run at logon. What is the most significant system behavior indicator that this registry key is malicious?

   • AThe registry key was created recently
   • BThe script is stored in the Downloads folder, which is a user-writable location
   • CThe registry key is located in the HKCU hive rather than the HKLM hive
   • DThe script is a .bat file rather than an .exe file
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An incident response team is investigating a breach. They have the following evidence: (1) a malicious executable was downloaded to a user's machine at 10:00 AM, (2) the executable created a service at 10:05 AM, (3) the service made an outbound connection to an external IP at 10:10 AM, and (4) the user's credentials were used to access an internal file share at 10:15 AM. The team needs to determine the scope of the breach. What is the most important question to answer?

   • ADid the service run under a user account with administrative privileges?
   • BWas the external IP address previously seen in other incidents?
   • CDid the malicious executable have a valid code-signing certificate?
   • DWas the outbound connection encrypted?
   Reveal Solution Discussion Select an answer first