During a network behavior analysis, an analyst notices a workstation generating a large volume of DNS queries for random subdomains under a single domain, with each query receiving a response containing a different IP address. The workstation is also running an unusual process that is not present on other similar machines. What does this pattern most likely indicate?

A network scan performed by the security team

A misconfigured DNS resolver causing cache pollution

DNS tunneling used for command-and-control communication

Normal behavior from a legitimate content delivery network

A network analyst is examining traffic from a compromised host and sees that it is communicating with a server on port 53 using DNS queries that contain encoded data in the subdomain labels. The host also has a process that is injecting code into other processes. What is the most likely purpose of the DNS queries?

To exfiltrate data or receive commands via DNS tunneling

To perform a DNS amplification attack

To resolve legitimate domain names for normal web browsing

A security analyst is reviewing network captures from a compromised Linux server. The server is making periodic outbound connections to a remote IP on port 443, but the TLS handshake fails and the server immediately reconnects. The process making the connections is not listed in the server's process table. What is the most likely explanation for this behavior?

A rootkit is hiding the process and the failed TLS handshake indicates the C2 server is temporarily unavailable

The server is running a legitimate service that uses a custom TLS implementation

The connections are caused by a misconfigured monitoring agent that is failing to authenticate

The network capture is incomplete and the process is actually visible in the process table

EC-CouncilDigital Forensics Essentials

Domain 7Objective 5

System and Network Behavior Analysis DFE Practice Questions (Page 8)

Part of the Malware Forensics domain, which makes up ~15% of our current practice bank.

38questions here

8free pages

3concepts

Questions 36–38

36application · medium
During a network behavior analysis, an analyst notices a workstation generating a large volume of DNS queries for random subdomains under a single domain, with each query receiving a response containing a different IP address. The workstation is also running an unusual process that is not present on other similar machines. What does this pattern most likely indicate?
Select an answer first
37application · medium
A network analyst is examining traffic from a compromised host and sees that it is communicating with a server on port 53 using DNS queries that contain encoded data in the subdomain labels. The host also has a process that is injecting code into other processes. What is the most likely purpose of the DNS queries?
Select an answer first
38application · medium
A security analyst is reviewing network captures from a compromised Linux server. The server is making periodic outbound connections to a remote IP on port 443, but the TLS handshake fails and the server immediately reconnects. The process making the connections is not listed in the server's process table. What is the most likely explanation for this behavior?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

System and Network Behavior Analysis DFE Practice Questions (Page 8)

Questions 36–38

Keep studying — Malware Forensics