Malware Propagation Techniques and Indicators EHE Practice Questions (Page 5)

Questions 21–25

1. 21application · easy

   A helpdesk technician is assisting a user whose computer has become noticeably slower and is displaying unexpected pop-ups. The user also mentions that some files in their Documents folder have been modified without their knowledge. Which set of indicators best describes what the technician is observing?

   • APropagation indicators, including email attachments and malicious downloads.
   • BBehavioral indicators, including system slowdown and unexpected pop-ups, along with file modifications as a system indicator.
   • CSystem indicators only, such as registry changes and unusual processes.
   • DNetwork indicators, including abnormal outbound connections and DNS queries.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is analyzing a malware infection on a workstation. The malware was delivered via a drive-by download from a compromised website. After execution, the malware created a service named 'Windows Defender Update' and began making DNS queries to a domain that is not on any allowlist. The queries are for random subdomains. Which propagation technique and indicators are present?

   • AEmail attachment as the propagation technique, with a network indicator (the new service) and a system indicator (the random DNS queries).
   • BDrive-by download as the propagation technique, with a system indicator (the new service) and a network indicator (the random DNS queries).
   • CTrojan disguised as a legitimate program as the propagation technique, with a behavioral indicator (the random DNS queries).
   • DWorm exploiting a network service as the propagation technique, with a system indicator (the new service) and a behavioral indicator (the random DNS queries).
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a network-based indicator that a system might be communicating with a command-and-control server?

   • AA successful VPN connection to the corporate network
   • BA high volume of legitimate web traffic to a popular website
   • CAn email being sent to a colleague
   • DUnusual outbound connections to a known malicious IP address
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A security analyst notices that the Windows Registry has been modified to add a new entry under Run keys. Which type of indicator does this represent?

   • AFile modification indicator
   • BSystem-level indicator of malware infection
   • CNetwork indicator of command-and-control
   • DBehavioral indicator of system slowdown
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network analyst observes a workstation sending a large volume of DNS queries for random subdomains under a single domain that is not on any corporate allowlist. The queries occur every few minutes, and the workstation is also making HTTPS connections to an IP address that has no reverse DNS record. Which conclusion is most supported by these observations?

   • AThe workstation is performing a legitimate software update that uses dynamic DNS.
   • BThe workstation has a misconfigured DNS resolver that is generating random queries.
   • CThe workstation is infected with a worm that is scanning for vulnerable network services.
   • DThe workstation is likely infected with malware using DNS as a covert channel for command-and-control communication.
   Reveal Solution Discussion Select an answer first