Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An endpoint detection and response (EDR) alert shows that a process named 'notepad.exe' has a network connection to an external IP on port 53. The process is running from 'C:\Users\Public\Documents\notepad.exe' instead of the standard Windows directory. The file's digital signature is invalid. What does this combination of indicators most likely suggest?

   • AA user running a portable version of Notepad from a USB drive.
   • BA legitimate copy of Notepad that was moved by a user.
   • CA false positive from the EDR due to a recent Windows update.
   • DA covert tool disguised as Notepad, using DNS for communications.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During incident response, an analyst finds a process named 'svch0st.exe' running from the user's Temp directory. The process has an established TCP connection to an external IP on port 443, and the parent process is a document reader. Which finding most strongly indicates that this is a covert communications tool rather than a legitimate process?

   • AThe process has an established connection on port 443.
   • BThe process is running from the user's Temp directory and has a document reader as its parent.
   • CThe process is using a network connection at all.
   • DThe process name is similar to a legitimate Windows service.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices a server that normally communicates with a few known update repositories is now sending small, periodic HTTPS packets to a single IP address in a foreign country at 3-minute intervals, every hour, even at night. The server's endpoint protection shows no alerts, and the packets are encrypted. Which action is most appropriate to confirm whether this is covert communications?

   • ADisable the server's outbound HTTPS traffic to all destinations.
   • BBlock the foreign IP at the firewall immediately and isolate the server.
   • CRun a full antivirus scan on the server and reimage it if nothing is found.
   • DCompare the server's netflow data with its known baseline and review the TLS certificate and destination reputation.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization's IDS alerts on outbound DNS queries containing long subdomains with high entropy to a domain that was only registered last week. The firewall logs show the same workstation making these queries every few minutes. Endpoint logs show a process named 'winupdate.exe' in the user's AppData folder that makes DNS queries. Which action should the incident responder take first?

   • ADelete the 'winupdate.exe' file from the workstation.
   • BBlock the malicious domain at the DNS firewall and continue monitoring.
   • CIsolate the workstation from the network and preserve the endpoint logs.
   • DRebuild the workstation from a known-good image.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which file artifact is commonly associated with covert communications tools?

   • AA file named 'photo.jpg' that is actually a PE executable
   • BA file named 'readme.txt' in the system32 directory
   • CA file named 'config.ini' in the application data folder
   • DA file named 'update.exe' in the user's Downloads folder
   Reveal Solution Discussion Select an answer first