Detecting Exploitation and Covert Communications Tools GCIH Practice Questions (Page 9)

Questions 41–42

1. 41expert · hard

   A SOC analyst is investigating an alert about a workstation communicating with a known malicious IP over port 53. The firewall log shows the traffic, but the DNS server logs do not show any corresponding DNS queries for that IP. The workstation's EDR shows no malicious processes. Which conclusion is most likely?

   • AThe workstation is using a direct TCP connection to the IP on port 53, bypassing the DNS server.
   • BThe DNS server logs are incomplete and the traffic is legitimate DNS.
   • CThe EDR is not detecting the malicious process because it is kernel-level.
   • DThe firewall log is a false positive and the traffic is benign.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network analyst observes that a workstation is sending DNS queries to an external server for long, random subdomains under a single domain, such as 'a3f9c2.example.com'. The queries occur at regular intervals and the responses are larger than typical DNS responses. No other workstations show this pattern. What does this behavior most likely indicate?

   • AA web browser prefetching DNS entries for a frequently visited site.
   • BA covert DNS tunneling channel used to exfiltrate data or issue commands.
   • CA misconfigured DNS resolver that is caching external domains.
   • DA legitimate content delivery network using dynamic subdomains for load balancing.
   Reveal Solution Discussion Select an answer first