Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is investigating a potential data exfiltration. The firewall logs show that a workstation has been sending large amounts of data to an external IP on port 443, but the TLS certificate presented by the external server is self-signed and the traffic pattern is constant, not bursty like typical web browsing. The workstation's EDR shows no malicious processes. Which approach best confirms whether this is covert communications?

   • ACompare the traffic pattern to the workstation's baseline and check the destination IP's reputation and certificate history.
   • BBlock the external IP at the firewall and assume the issue is resolved.
   • CRun a memory dump on the workstation and analyze it for hidden processes.
   • DDecrypt the TLS traffic using a man-in-the-middle proxy to inspect the payload.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network security analyst is reviewing packet captures and notices that a client is sending ICMP echo requests with payloads that contain repeating patterns of ASCII text, and the corresponding echo replies contain data that looks like a directory listing. The client is a standard user workstation. Which type of activity is this?

   • AA covert channel using ICMP to exfiltrate data.
   • BA misconfigured network monitoring agent.
   • CA legitimate backup process using ICMP for status updates.
   • DA network diagnostic tool running a ping sweep.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which host-based artifact is most commonly associated with covert communications tools?

   • AA process named 'svchost.exe' running from a temporary directory
   • BA process named 'cmd.exe' running with command-line arguments
   • CA process named 'notepad.exe' running with no open windows
   • DA process named 'explorer.exe' running from the Windows directory
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst notices a workstation generating a steady stream of small ICMP echo requests to an external IP at exactly 500-millisecond intervals, 24/7. The payloads are all the same size and contain repeating non-ASCII bytes. No other host in the environment exhibits this pattern. What is the most appropriate next step?

   • ARebuild the workstation from a known-good image immediately.
   • BIsolate the host and capture full packet captures for analysis of the ICMP payloads.
   • CIgnore the traffic because ICMP is commonly used for network troubleshooting.
   • DBlock all ICMP traffic at the firewall and close the case.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is reviewing a packet capture and notices that a series of JPEG images are being transferred from an internal server to an external IP. The images appear to be normal photos, but the file sizes are larger than expected for the resolution. The analyst also notices that the least significant bits of the image pixels contain non-random patterns. What is the most likely explanation?

   • AThe images are being sent to a legitimate photo-sharing service.
   • BThe images contain hidden data using steganography.
   • CThe images are being compressed and resized by the server before transfer.
   • DThe images are corrupted during transmission.
   Reveal Solution Discussion Select an answer first