Detecting Modern Attacks GEIR Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard · select all that apply

   A security analyst is correlating several alerts to determine if they are part of a single attack chain. The alerts are: (1) a user clicked a link in a phishing email, (2) a new scheduled task was created on the user's workstation, (3) the workstation made a connection to a known C2 domain, and (4) a large outbound data transfer occurred from the workstation. Select all that, when correlated, would most strongly indicate a complete attack chain from initial access to exfiltration.

   • AThe scheduled task runs a script that is similar to a known malware family
   • BThe C2 connection and the outbound data transfer occurred within a short time window
   • CThe user who clicked the phishing email has administrative privileges on the workstation
   • DThe phishing email and the scheduled task creation occurred on the same workstation
   Check answers Discussion Select an answer first
2. 17application · medium

   During an incident investigation, an analyst finds a scheduled task that runs PowerShell with an encoded command every hour. The task was created by an unknown user SID. Which detection control would have most reliably identified this persistence mechanism earlier?

   • AMonitoring for new scheduled tasks that execute PowerShell with encoded arguments.
   • BEnabling Windows Defender Application Control to block all PowerShell execution.
   • CReviewing daily backups for changes to the Windows registry.
   • DChecking the security event log for failed logon attempts on the host.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which detection method is most effective for identifying pass-the-hash attacks?

   • AReviewing DNS logs for unusual domain queries
   • BChecking email quarantine reports
   • CScanning for open ports on servers
   • DMonitoring for the use of NTLM authentication from multiple hosts with the same account
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A user reports receiving an email that appears to be from the company's IT department, urging them to click a link to 'verify their account' within 24 hours. The email's domain is similar but not identical to the corporate domain. The security team wants to detect this type of attack early in the kill chain. Which detection approach is most effective for identifying this initial access vector before the user interacts with it?

   • AConfigure the firewall to block all outbound traffic to domains not on the corporate allowlist
   • BDeploy a mail gateway rule that flags external emails with lookalike domains and adds a banner warning to the message
   • CSet up an alert for any user who enters credentials into a web form that is not on the corporate SSO page
   • DEnable verbose logging on the user's workstation to capture any process execution after the link is clicked
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team notices that a host is making DNS queries for domains that look like random characters followed by '.com'. The queries occur at irregular intervals and each domain resolves to a different IP. The host also communicates with those IPs on port 443. Which detection technique would be most effective at identifying this as C2?

   • AUse machine learning to detect domain generation algorithm (DGA) patterns in DNS queries.
   • BCheck the host's ARP cache for unusual MAC addresses.
   • CBlock all outbound traffic on port 443 to unknown IPs.
   • DImplement a DNS sinkhole for domains with high entropy and short TTLs.
   Reveal Solution Discussion Select an answer first