Detecting Modern Attacks GEIR Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An incident responder discovers that a compromised host has a new Windows service that runs an executable from a hidden directory. The service is configured to start automatically. Which detection method would have most likely identified this persistence mechanism?

   • AReviewing the Windows event log for service crashes.
   • BMonitoring for new services that point to non-standard executable paths.
   • CChecking the host's firewall rules for inbound connections.
   • DRunning a full disk scan for hidden files.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst notices a workstation making DNS queries to a random-looking domain every 60 seconds, with each query returning a different IP. The domain was registered three days ago. Which detection technique would most directly confirm this as command and control (C2) rather than a false positive?

   • AEnable DNS logging and correlate the query frequency with the workstation's outbound connection patterns to the returned IPs.
   • BCheck the workstation's browser history for visits to the random-looking domain.
   • CBlock the domain at the firewall and observe whether the workstation generates additional alerts.
   • DRun an antivirus scan on the workstation to identify the malware responsible for the DNS queries.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company has implemented email filtering and user awareness training, but still experiences successful phishing attacks that lead to credential compromise. Which additional detection control would be most effective at identifying these attacks earlier?

   • ADeploy a web proxy that blocks access to known malicious domains.
   • BMonitor for anomalous login behavior, such as impossible travel or new device logins.
   • CIncrease the frequency of security awareness training to monthly sessions.
   • DImplement multi-factor authentication (MFA) on all user accounts.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company suspects that an attacker is exfiltrating data by encoding it in DNS queries to a domain they control. The company's DNS logs show a high volume of TXT record queries to a single domain, but the responses are small. Which detection approach would best confirm this exfiltration technique?

   • ABlock all DNS queries to external domains to prevent exfiltration
   • BAlert on any DNS query for a TXT record to a domain that is not on the corporate allowlist
   • CMonitor the volume of DNS queries and alert on any increase above a baseline
   • DAnalyze the content of the TXT record responses for encoded data patterns, such as base64 or hex
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of correlating disparate detection signals?

   • ATo automatically patch vulnerabilities
   • BTo identify a chain of events that indicates a multi-stage attack
   • CTo reduce the number of security tools needed
   • DTo replace the need for human analysts
   Reveal Solution Discussion Select an answer first