Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident responder discovers that an attacker is using SSH tunneling to exfiltrate data from a compromised server. The SSH connection is established from the server to an external IP on port 22, and the tunnel is carrying internal database traffic. Which containment action is most effective while preserving evidence?

   • ATerminate the SSH session and isolate the server from the network.
   • BDisable SSH service on the server.
   • CBlock outbound SSH traffic at the firewall.
   • DChange the SSH port to a non-standard port.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is investigating a host that is suspected of using steganography to hide data in image files. Which host-based artifact would provide the strongest evidence of steganography tool usage?

   • AA process named 'stegtool.exe' running from a temporary directory.
   • BA recently installed image editing application.
   • CA large number of image files in the user's Downloads folder.
   • DAn unusual number of image files with the same file size.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is most effective for eradicating a covert communications tool from an endpoint?

   • ABlock the IP address of the command-and-control server in the firewall
   • BDisable the network interface on the endpoint
   • CNotify the user to stop using the application
   • DTerminate the malicious process and remove the associated files and registry entries
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   During incident response, you find a process named 'winword.exe' running on a server that does not have Microsoft Office installed. The process has a network connection to an external IP on port 53, and the file's hash matches a known covert tool. The server is a critical application server that cannot be taken offline. Which action best balances containment and evidence preservation?

   • AKill the process and copy the executable to a forensic server for analysis.
   • BImmediately shut down the server to prevent further damage.
   • CBlock the external IP at the firewall and continue monitoring the process.
   • DIsolate the server at the network level and capture a memory image before killing the process.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization's firewall logs show a workstation making frequent HTTPS connections to a known file-sharing domain. Endpoint logs show a process named 'update.exe' running from the user's AppData folder. The process has not been seen before, and the user denies installing any software. Which set of indicators most strongly suggests a covert communications tool?

   • AA process named 'update.exe' running from AppData.
   • BThe combination of an unknown process in AppData and frequent HTTPS connections to a file-sharing domain.
   • CThe user's denial of installing software.
   • DHTTPS connections to a file-sharing domain.
   Reveal Solution Discussion Select an answer first