Malware and AI Assisted Investigations GCIH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst receives a suspicious executable from an employee. The analyst needs to determine whether the file is malicious without executing it. The analyst calculates the file's SHA-256 hash and queries VirusTotal, which shows no detections. The analyst then runs `strings` and finds URLs to a known malware distribution domain. Which additional static analysis step would most directly confirm the file's malicious nature?

   • ACheck the file's digital signature to see if it was signed by a reputable vendor.
   • BRun the file in a virtual machine and observe its network connections.
   • CCompare the file's import table against a list of Windows API calls commonly used by keyloggers.
   • DSubmit the file to an online sandbox for automated dynamic analysis.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An analyst is analyzing a malware sample that is packed. The analyst wants to unpack it to perform static analysis. The sample is known to use a custom packer that is not recognized by common unpacking tools. What is the best approach to unpack the sample?

   • ASubmit the sample to an online sandbox and hope it unpacks automatically
   • BSkip static analysis and only perform dynamic analysis
   • CUse a generic unpacker tool that claims to handle all packers
   • DRun the sample in a debugger and dump the process memory after the unpacking routine executes
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A malware analyst is using an AI-based classification tool that was trained on a dataset containing personal information from a previous incident. The analyst wants to share the tool's findings with a third-party threat intelligence sharing group. What is the most appropriate ethical and legal action?

   • ARefuse to share any information because AI findings are always unreliable
   • BAnonymize or remove any personal data from the findings before sharing
   • CShare the raw AI model outputs, including any personal data, to help the community
   • DShare the information only if the AI tool is open source
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An incident response team is overwhelmed by the volume of alerts during a widespread malware outbreak. They decide to use an AI-based triage system to prioritize alerts. What is the best way to ensure the AI system does not miss critical alerts?

   • ADisable the AI system and rely on manual triage to ensure nothing is missed.
   • BConfigure the AI system to automatically respond to all alerts without human review.
   • CSet the AI system to escalate any alert with a confidence score above 50% to a human analyst.
   • DRegularly validate the AI system's decisions against known incident outcomes and adjust thresholds accordingly.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is evaluating two AI-based malware detection tools. Tool A has a high detection rate but also a high false-positive rate. Tool B has a lower detection rate but a very low false-positive rate. The team has limited analyst resources and cannot investigate many false positives. Which tool should the team choose?

   • AUse both tools and investigate all alerts from both.
   • BTool A, because detecting more malware is more important than avoiding false positives.
   • CTool B, because the low false-positive rate will reduce alert fatigue and allow analysts to focus on real threats.
   • DUse Tool A but increase the confidence threshold to reduce false positives.
   Reveal Solution Discussion Select an answer first