Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a common host-based indicator of exploitation?

   • AA web server responding to HTTP requests on port 80
   • BA user logging in during normal business hours from a known workstation
   • CA file being copied from one folder to another on the same drive
   • DA scheduled task that runs a PowerShell script to download and execute a payload
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An incident responder has confirmed that a server is using a covert channel over HTTP to communicate with a command-and-control server. The responder needs to contain the threat while minimizing disruption to legitimate web services hosted on the same server. Which action best achieves this?

   • ABlock all outbound HTTP traffic from the server.
   • BDisable the web server service on the server.
   • CCreate a firewall rule to block traffic to the specific command-and-control IP address.
   • DIsolate the server from the network and analyze the traffic offline.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An incident responder is analyzing a host that is suspected of using a covert communications tool. The host has a process named 'svchost.exe' running from the System32 directory, which is normal. However, the process has a network connection to an external IP on port 443, and the user has no reason to have such a connection. The process's command line includes a suspicious flag. Which action would best confirm whether this is a covert tool?

   • ATerminate the process immediately.
   • BRebuild the host from a known-good image.
   • CCheck the process's digital signature.
   • DBlock the external IP at the firewall.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An incident responder is analyzing a compromised Windows server. The responder finds a new service named 'UpdateService' that is set to auto-start. The service binary is located in 'C:\Windows\Temp\update.exe'. The server's security logs show that the service was created at the same time as a successful logon from a remote IP. The file's hash is not in the vendor's database. Which action is most appropriate to confirm the service is malicious?

   • ADisable the service and monitor the server for further suspicious activity.
   • BDelete the service and the binary, then reboot the server.
   • CCheck the service's dependencies and the binary's digital signature and compare the hash to known malware databases.
   • DRun a full antivirus scan on the server and rely on the results.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization's IDS alerts on a series of HTTP requests to a web server that contain a long string of base64-encoded data in the URL parameter. The web server logs show the requests originated from a single internal IP that is not a known admin workstation. The requests are interspersed with normal-looking requests to the same server. What is the best next step?

   • ACorrelate the IDS alert with web server logs and check for corresponding responses or errors.
   • BImmediately shut down the web server to prevent further exploitation.
   • CDecode the base64 string to see if it contains a known exploit payload.
   • DBlock the internal IP at the firewall and ignore the IDS alert.
   Reveal Solution Discussion Select an answer first