Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common indicator of a covert channel in network traffic?

   • ATraffic that follows a predictable pattern of request and response
   • BTraffic on a non-standard port that is not associated with any known application
   • CTraffic that is consistently encrypted with TLS
   • DTraffic that is limited to a single IP address
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the immediate containment action when a system is confirmed to be communicating over a covert channel?

   • AChange the user's password
   • BRebuild the system from a known-good image
   • CDelete the malicious files from the system
   • DIsolate the affected system from the network
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which network traffic pattern is most likely to indicate exploitation activity?

   • AAn email attachment being scanned by the mail server
   • BA single large file transfer to a cloud storage service
   • CRepeated outbound connections to an IP address on a non-standard port at regular intervals
   • DA user browsing a corporate intranet site
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An incident responder is examining a compromised Linux server. The responder finds a suspicious binary in /tmp that is not in the package manager's database. The binary has the SUID bit set and is owned by root. The server's auth.log shows multiple failed SSH login attempts from a single IP just before the binary appeared. What is the most likely sequence of events?

   • AThe binary is a false positive from the file system scanner.
   • BThe attacker used a vulnerability to gain root access and placed a backdoor binary.
   • CThe server was compromised by a worm that spread through the network.
   • DA legitimate administrator installed a custom tool for system administration.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An organization discovers that an attacker is using steganography to exfiltrate data via images uploaded to a public-facing web server. The images are posted to a legitimate photo-sharing feature on the website. The attacker's IP is unknown, and the uploads appear to come from various legitimate user accounts. Which response strategy is most effective in stopping the exfiltration?

   • ABlock the IP addresses of the user accounts that uploaded the images.
   • BIncrease the maximum upload file size to accommodate larger images.
   • CImplement a detection rule that flags images with high entropy in the least significant bits and review them manually.
   • DDisable the photo-sharing feature on the web server.
   Reveal Solution Discussion Select an answer first