Detecting Evasive and Post-Exploitation Techniques GCIH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An incident responder wants to detect lateral movement by identifying anomalous authentication events across multiple hosts. Which log source is most directly useful for this detection?

   • AAuthentication logs from domain controllers and endpoints
   • BWeb proxy logs
   • CDNS query logs
   • DNetFlow data
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A malware analyst is examining a PowerShell script that uses a series of XOR operations and string reversals to construct a command line that downloads a payload. Which evasion technique is the script primarily using?

   • AObfuscation
   • BPacking
   • CEncoding
   • DEncryption
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   To detect encoded PowerShell commands executed on a host, which detection strategy is most effective when reviewing host-based logs?

   • AMonitor for high network traffic from the host
   • BCheck for the presence of common malware file names
   • CReview firewall logs for outbound connections
   • DEnable PowerShell script block logging and review logs for suspicious encoded command patterns
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is investigating a malware outbreak. The malware is known to use a custom protocol over DNS to communicate with its command-and-control server. The team has limited resources and must choose a detection strategy. Which strategy would be most effective in detecting this malware?

   • AMonitor for unusual outbound traffic on port 53
   • BMonitor DNS logs for unusual queries, such as long subdomains or high query volume to a single domain
   • CMonitor for high CPU usage on DNS servers
   • DBlock all DNS traffic to external servers
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is investigating a breach where the attacker used a legitimate Windows tool (e.g., PowerShell) to perform reconnaissance and lateral movement. The team wants to detect this activity but has limited logging enabled. Which detection strategy would be most effective given the limited logging?

   • AMonitor for the creation of new user accounts
   • BEnable PowerShell script block logging and monitor for suspicious commands
   • CMonitor for unusual network connections to internal systems
   • DMonitor for changes to the Windows registry
   Reveal Solution Discussion Select an answer first