Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which technique is commonly used by covert communications tools to bypass network security controls?

   • AUsing only standard ports and protocols without any modification
   • BDisabling all logging on the target system
   • CTunneling malicious traffic inside allowed protocols such as HTTP or DNS
   • DSending all traffic in plaintext to avoid encryption detection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During incident response, you confirm that an attacker is using a covert channel over HTTPS to a command-and-control server. The affected workstation is a developer's machine that is currently in use. Which containment action is most appropriate to minimize disruption while stopping the covert channel?

   • ABlock the specific command-and-control IP at the firewall and allow other traffic.
   • BShut down the workstation and reimage it.
   • CKill the process associated with the covert channel and continue monitoring.
   • DDisconnect the workstation from the network immediately.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization's IDS alerts on outbound DNS queries with high entropy subdomains from a single workstation. The firewall logs show the same workstation making these queries to a domain that was registered three days ago. Endpoint logs show a process named 'svchost.exe' running from the user's Temp directory. The user is a marketing employee who does not typically use DNS for anything other than web browsing. Which conclusion is most justified?

   • AThe DNS queries are caused by a misconfigured browser.
   • BThe workstation is running a legitimate DNS-based application.
   • CThe DNS queries are benign and require no action.
   • DThe workstation is compromised and using DNS tunneling to exfiltrate data.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a forensic investigation, an analyst finds a file named 'photo.jpg' in a user's directory that is 5 MB in size. The user has no other large image files. The file's creation time matches the time of a suspected data exfiltration event. Which action would best confirm whether the file contains hidden data?

   • ADelete the file to prevent further data loss.
   • BOpen the image in a standard image viewer.
   • CCheck the file's hash against a known-good database.
   • DRun a steganography detection tool on the file.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization discovers that an attacker is using a covert channel over HTTPS to exfiltrate data from a server. The server is a legacy system that cannot be patched and is required for a critical business process. The attacker's IP is dynamic and changes frequently. Which response strategy is most effective in the long term?

   • ADisable outbound HTTPS from the server to all destinations.
   • BBlock the current attacker IP at the firewall and monitor for new IPs.
   • CImplement a network-based detection rule that alerts on the specific traffic pattern and isolate the server if it recurs.
   • DReplace the server with a modern, patched system immediately.
   Reveal Solution Discussion Select an answer first