Malware and AI Assisted Investigations GCIH Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   An incident response team is investigating a file that an AI-based classifier labels as 'likely malware' with 90% confidence. Static analysis shows the file is a signed executable from a reputable vendor, but it also contains a suspicious DLL that is not signed. The team must decide whether to block the file across the enterprise. The file is used by a critical business application. What is the best course of action?

   • ABlock the file immediately because the AI confidence is high
   • BPerform additional analysis, such as dynamic analysis of the DLL, before deciding
   • CAllow the file because it is signed by a reputable vendor
   • DQuarantine the file and replace it with an older version
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   During incident response, an analyst observes a file that, when executed, encrypts user documents and displays a ransom note demanding payment in cryptocurrency. Which type of malware is this an example of?

   • ATrojan
   • BWorm
   • CRansomware
   • DSpyware
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An analyst needs to safely execute a malware sample to observe its behavior. The sample is known to potentially spread via network shares. Which environment setup is most appropriate for dynamic analysis?

   • AAn isolated virtual machine with no network access and snapshots
   • BA shared sandbox environment with other analysts' samples
   • CA production server with network shares to observe real-world impact
   • DA physical machine connected to the corporate network
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company is implementing an AI-based incident response system that can automatically contain threats. The system uses a machine learning model to decide whether to isolate a host. The model was trained on historical data from the company's environment. During a real incident, the model fails to isolate a host that later spreads malware. What is the most likely reason for this failure?

   • AThe model is not capable of making real-time decisions
   • BThe model is too conservative because it was trained to avoid false positives
   • CThe model was not integrated with the containment tools
   • DThe model was not trained on enough data
   Reveal Solution Discussion Select an answer first