Detecting Modern Attacks GEIR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an incident, a security analyst detects a suspicious scheduled task on a server that is executing a PowerShell script. The analyst wants to integrate this finding into the incident response process. Which action is most appropriate to take first?

   • ADocument the finding, preserve the scheduled task and script for analysis, and then escalate to the incident response team
   • BDisable the scheduled task immediately to stop the malicious activity
   • CDelete the scheduled task and the PowerShell script to remove the threat
   • DRun the PowerShell script in a sandbox to understand its behavior before taking action
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an incident, an analyst observes that a service account with administrative privileges on several servers is being used to create scheduled tasks on those servers. The account's normal behavior does not include creating scheduled tasks. Which detection rule would best identify this as a potential lateral movement and persistence technique?

   • AAlert on any scheduled task creation event where the task runs with highest privileges
   • BAlert on any use of the service account to create a scheduled task on a server outside its normal administrative scope
   • CAlert on any successful logon by the service account from a different workstation
   • DAlert on any scheduled task that executes a PowerShell script
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization suspects data exfiltration via DNS tunneling. Which detection approach would be most effective?

   • ABlock all DNS queries to external servers and use only internal DNS.
   • BMonitor DNS query volume and size for anomalies, such as large TXT records or high query rates.
   • CReview firewall logs for connections to port 53 from internal hosts.
   • DInspect all DNS traffic for the presence of the organization's domain name.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations center receives three alerts: a phishing email that was blocked by the gateway, a successful logon from an unusual location for a standard user, and a credential dump attempt on a domain controller. The SOC has limited staff and must prioritize. Which alert should be investigated first?

   • AThe credential dump attempt on the domain controller, because it indicates an active attack on a high-value target
   • BThe phishing email that was blocked, because it indicates an attempted initial access
   • CThe successful logon from an unusual location, because it may indicate account compromise
   • DAll three alerts should be investigated simultaneously because they may be part of the same attack chain
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is investigating a potential pass-the-hash attack. They have enabled logging of NTLM authentication events on domain controllers. However, they are seeing many false positives from legitimate application service accounts that use NTLM. Which approach would best reduce false positives while still detecting pass-the-hash?

   • ADisable NTLM authentication across the domain to force Kerberos
   • BCreate a baseline of NTLM authentication patterns for each service account and alert on deviations
   • CAlert on any NTLM authentication event that originates from a workstation that is not the account's primary workstation
   • DAlert on any NTLM authentication event that uses a service account
   Reveal Solution Discussion Select an answer first