Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) analyst sees a firewall log entry showing outbound traffic from a database server to an external IP on port 22. The IDS shows no alert for this traffic, and the endpoint agent on the database server shows no unusual processes. However, the database server is not supposed to initiate SSH connections. What should the analyst do first?

   • ABlock all outbound SSH traffic from the database server at the firewall.
   • BReview the IDS configuration to see why it did not alert on the SSH traffic.
   • CCheck the database server's process list and network connections to identify the process responsible for the SSH connection.
   • DIgnore the traffic because the IDS and endpoint agent show no alerts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of using steganography in covert communications?

   • ATo authenticate the sender of the message
   • BTo encrypt the data so that it cannot be read without the key
   • CTo compress the data to reduce bandwidth usage
   • DTo hide the existence of the communication within innocuous-looking data
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is reviewing a packet capture and notices a series of TCP connections to an external IP on port 443, but the TLS handshake fails and the payloads contain plaintext data that looks like base64. The connections occur in bursts every few minutes. Which indicator is most consistent with a covert channel?

   • AThe bursts of connections every few minutes.
   • BThe external IP address being new to the environment.
   • CThe failed TLS handshake and plaintext base64 payloads.
   • DThe use of port 443 for TCP connections.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During incident response, you find a process named 'svch0st.exe' running on a compromised Windows workstation. The process has an open TCP connection to an external IP on port 443, and the file's hash matches a known covert tunneling tool. The workstation is not a server and does not normally initiate outbound HTTPS connections. Which immediate action is most appropriate?

   • AKill the process and delete the executable from disk.
   • BBlock the external IP at the firewall and continue monitoring the workstation.
   • CRun a full antivirus scan and rely on the results to determine next steps.
   • DIsolate the workstation from the network and capture a memory image before terminating the process.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A network analyst is reviewing traffic and sees a series of HTTP requests to a web server that hosts a legitimate file-sharing service. The requests include a parameter that contains a long string of base64-encoded data. The responses are normal images. The analyst suspects steganography. Which additional finding would most strongly support this hypothesis?

   • AThe requests come from a single IP address.
   • BThe base64-encoded data decodes to random-looking bytes.
   • CThe responses are images with large file sizes.
   • DThe requests occur at regular intervals.
   Reveal Solution Discussion Select an answer first