Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which scenario best illustrates the value of log correlation?

   • AAn IDS alert fires for a known malware signature, and the endpoint is quarantined
   • BA user reports a phishing email, and the email is deleted from the mailbox
   • CA server logs a high CPU usage, and the administrator reboots the server
   • DA firewall log shows a blocked inbound connection from an unknown IP, and an endpoint log shows a new process spawned shortly after
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Why is correlating logs from multiple sources important in incident detection?

   • AIt ensures that all alerts are automatically resolved
   • BIt eliminates the need for endpoint detection tools
   • CIt reduces the amount of data that needs to be stored
   • DIt helps distinguish benign activity from malicious activity by providing a broader context
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is examining network traffic and sees a series of HTTP requests to a website that hosts images. The requests include a parameter that contains a long string of base64-encoded data. The images themselves appear normal when viewed. Which technique is most likely being used?

   • AICMP tunneling
   • BSteganography in HTTP requests
   • CDNS tunneling
   • DPort tunneling
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which network traffic anomaly is most indicative of a DNS tunneling covert channel?

   • AA single DNS query for a well-known website
   • BDNS queries that occur only during business hours
   • CA high volume of DNS queries to a single domain with long subdomain labels
   • DDNS queries that are all answered with the same IP address
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization's IDS alerts on outbound traffic from a database server to an external IP on port 53 using DNS queries with unusually long subdomains. The firewall logs show the same pattern. Endpoint logs show a process named 'dnsupdate.exe' running from the system's Temp directory. Which action should the incident responder take to confirm the covert channel?

   • ACapture full packet captures of the DNS traffic and analyze the payloads.
   • BBlock the external IP at the firewall.
   • CDisable DNS on the database server.
   • DRebuild the database server from a known-good image.
   Reveal Solution Discussion Select an answer first