Detecting Evasive and Post-Exploitation Techniques GCIH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security analyst observes multiple failed logon attempts followed by a successful logon from the same source IP to a domain controller, and then the source IP immediately connects to other workstations using the same credentials. This pattern is most indicative of which post-exploitation activity?

   • APersistence mechanism
   • BLateral movement
   • CPrivilege escalation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization has enabled PowerShell script block logging and transcription. During a review, an analyst finds a script that uses base64-encoded strings and invokes the .NET classes to download and execute a payload. Which detection strategy would best identify this activity in the logs?

   • ASearch for the base64-encoded strings in the logs
   • BLook for the absence of script block logs
   • CDecode the base64 strings and search for the decoded content in the logs
   • DCheck the Windows Event Log for process creation events only
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A malware analyst is examining a sample that uses a technique to check if it is running in a sandbox by looking for the presence of specific DLLs and checking the number of processors. If the DLLs are present or the processor count is low, the malware exits. Which evasion technique is the malware using, and what is the best way to detect it?

   • APolymorphism; use a signature-based scanner to detect the malware's variants
   • BEncryption; use a debugger to decrypt the malware's strings
   • CObfuscation; use static analysis to decode the malware's payload
   • DAnti-sandboxing; use a sandbox that mimics a real user environment with high processor count and common DLLs
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An analyst notices that a service named 'Windows Update Service' has been created on a compromised host, and its binary path points to a file in the user's Temp directory. This is most likely an indicator of which post-exploitation activity?

   • APrivilege escalation
   • BPersistence mechanism
   • CData exfiltration
   • DLateral movement
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An incident responder is examining a malicious executable that uses a packer to compress and encrypt its code. When the executable runs, it unpacks itself in memory. Which evasion technique is the executable using?

   • AAnti-sandboxing
   • BPacking
   • CObfuscation
   • DEncryption
   Reveal Solution Discussion Select an answer first