Malware Propagation Techniques and Indicators EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A forensic analyst is examining a compromised Windows workstation. The analyst finds a new service named 'Windows Update Helper' that is set to auto-start, and the user reports that the system occasionally freezes. Which combination of indicators is the analyst documenting?

   • AA system-level indicator (the new auto-start service) and a behavioral indicator (the system freezes).
   • BA propagation indicator (the service) and a network indicator (the freezes).
   • CA network indicator (the service name) and a propagation indicator (the auto-start behavior).
   • DA behavioral indicator (the new service) and a system-level indicator (the freezes).
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator is reviewing proxy logs and sees that a workstation is making periodic HTTPS requests to a domain that was registered only a few days ago. The requests occur every 60 seconds, and the responses are unusually large for the small request size. The workstation's user reports no unusual behavior. Which indicator is the administrator observing?

   • AA behavioral indicator, because the user reports no unusual behavior.
   • BA propagation indicator, because the domain is newly registered.
   • CA network indicator of command-and-control communication, with the periodic requests and large responses suggesting data exfiltration.
   • DA system-level indicator, because the requests come from a workstation.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A system administrator notices that a server has a new scheduled task that runs a PowerShell script every hour. The script downloads a file from an external URL and executes it. The administrator also sees that the server's hosts file has been modified to redirect a known security vendor's domain to 127.0.0.1. Which propagation technique and indicator are present?

   • AA trojan that was delivered via a malicious download, with the scheduled task and hosts file modification as system indicators.
   • BA virus that infected the PowerShell script, with the hosts file modification as a behavioral indicator.
   • CA drive-by download that exploited the browser, with the scheduled task as a propagation indicator.
   • DA worm that exploited a network service, with the scheduled task as a network indicator.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing firewall logs and notices that a single internal host is making outbound connections to multiple IP addresses on port 445, and some of those connections are being established successfully. The analyst also sees that the host recently downloaded a file from a file-sharing website. Which propagation technique is the analyst most likely observing?

   • AA drive-by download that is using the browser to spread to other hosts.
   • BA worm that is exploiting the SMB service to spread to other hosts on the network.
   • CA trojan that is using the file-sharing website to download additional payloads.
   • DA virus that is attaching itself to files on the file-sharing website.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security analyst is investigating a server that is exhibiting multiple signs of compromise: a new user account was created, a scheduled task runs an unknown binary, and the server is making outbound connections to a known malicious IP. The analyst also notes that the server's performance has degraded. Which combination of indicators is the analyst documenting?

   • ABehavioral indicators only (performance degradation and the new user account).
   • BNetwork indicators only (outbound connection and performance degradation).
   • CSystem-level indicators only (new user account and scheduled task).
   • DSystem-level indicators (new user account and scheduled task), a network indicator (outbound connection), and a behavioral indicator (performance degradation).
   Reveal Solution Discussion Select an answer first