Detecting Evasive and Post-Exploitation Techniques GCIH Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A malware analyst is examining a sample that uses a custom algorithm to generate domain names based on the current date. The malware attempts to connect to these domains to receive commands. The analyst wants to detect the malware's command-and-control activity in network logs. Which detection strategy would be most effective?

   • AMonitor for DNS queries to domains that match the algorithm's pattern
   • BSearch for the specific domains generated by the algorithm
   • CBlock all DNS queries to domains not on the allowlist
   • DCorrelate DNS queries with process creation events on the infected host
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that a workstation is making repeated DNS queries for subdomains that look like random hex strings under a domain that is not on any allowlist. The strings decode to ASCII when converted from hex. The analyst suspects the traffic is part of a command-and-control channel. Which detection strategy is most effective for confirming this behavior?

   • ABlock all DNS queries to domains not on the corporate allowlist.
   • BEnable DNS query logging and correlate with endpoint process creation events to identify which process is generating the queries.
   • CDisable recursive DNS resolution on the internal DNS server to prevent the queries from leaving the network.
   • DInspect the hex strings using a packet capture tool to decode them manually.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an incident, a forensic analyst finds a scheduled task on a compromised server that runs a PowerShell script every hour. The script downloads a small executable from a file-sharing site and executes it in memory. The analyst also finds that the server's local administrator account password was changed. Which two post-exploitation techniques are most clearly indicated by these findings?

   • ALateral movement and data exfiltration
   • BDefense evasion and credential dumping
   • CPersistence and privilege escalation
   • DCommand and control and exfiltration
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team wants to detect an attacker who is using a legitimate remote administration tool (RAT) like TeamViewer to control a compromised host. Which detection strategy would be most effective?

   • AMonitor for high CPU usage on the host
   • BMonitor for unusual login times
   • CBlock all outbound traffic on port 443
   • DMonitor for the execution of known remote administration tools and alert on their use outside of approved IT support
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization has a mature SIEM that ingests Windows Event Logs, including Sysmon, and network flow logs. During an investigation, an analyst finds that a compromised host is using WMI to execute commands on a remote server. The commands are obfuscated and the remote server is not showing any signs of compromise in its own logs. Which detection strategy would best uncover this activity?

   • ABlock WMI traffic on the network
   • BSearch for the obfuscated command strings in the SIEM
   • CCorrelate WMI process creation events on the remote server with network connections from the compromised host
   • DEnable verbose logging on the compromised host
   Reveal Solution Discussion Select an answer first