Malware as a Collection Source GCTI Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is analyzing a new trojan that uses a domain generation algorithm (DGA) to communicate with its C2 server. The analyst needs to predict future C2 domains to proactively block them. Which analysis technique would be most useful?

   • ASearch public threat intelligence feeds for domains associated with the trojan.
   • BMonitor the trojan's network traffic in a sandbox to observe current C2 domains.
   • CCheck the trojan's strings for hardcoded C2 domains.
   • DReverse engineer the trojan's DGA algorithm to generate a list of future domains.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of an indicator of compromise (IOC) that can be extracted from a malware sample?

   • AThe malware's SHA-256 file hash
   • BThe victim organization's internal network diagram
   • CThe malware author's social media account
   • DThe malware's license agreement
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A mature threat intelligence team is building a new collection capability focused on malware. The team has limited analyst time and must choose between two approaches: (1) deep manual analysis of a few high-value samples, or (2) automated sandbox analysis of a large volume of samples. The team's primary goal is to produce timely indicators for their security operations center (SOC) to block emerging threats. Which approach best balances effort and intelligence value?

   • AAutomated sandbox analysis only, with no manual follow-up, to maximize volume and speed.
   • BDeep manual analysis of a few high-value samples, ignoring the rest to ensure thorough understanding.
   • CManual analysis of every sample, regardless of volume, to ensure no intelligence is missed.
   • DAutomated sandbox analysis of a large volume of samples, with manual deep-dive only on samples that trigger high-severity alerts.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A malware analyst is analyzing a sample that is heavily obfuscated and uses anti-sandbox techniques, such as detecting virtual machines and delaying execution. Static analysis has not yielded useful indicators. The analyst needs to extract behavioral intelligence but must avoid the malware's evasion tactics. Which approach is most likely to succeed?

   • ARun the sample in a standard virtual machine with default settings and wait for the sandbox to report results.
   • BUse a bare-metal analysis environment with realistic network services and manually trigger the delayed execution path.
   • CSubmit the sample to multiple public sandboxes and combine their reports.
   • DPatch the sample's anti-sandbox checks in a debugger and then run it in a normal sandbox.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst at a mid-sized firm discovers a new trojan on a compromised workstation. The analyst needs to quickly determine the trojan's command-and-control (C2) infrastructure to block it at the firewall. The analyst has a sandbox environment available. Which approach should the analyst use?

   • APerform static analysis by examining the trojan's strings for potential domain names.
   • BCheck the workstation's DNS cache for recent lookups.
   • CSubmit the trojan to a public malware analysis service and wait for the report.
   • DRun the trojan in the sandbox and monitor outbound network connections to identify the C2 server address.
   Reveal Solution Discussion Select an answer first