Incident Response GIME Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   You are investigating a macOS system where a process is making outbound connections to an IP address that is also used by a legitimate business partner. The process name is similar to a known system process, but the binary path is unusual. You need to determine if this is malicious without disrupting business operations. Which action is most appropriate?

   • AAsk the user if they installed any new software recently.
   • BImmediately block the IP address at the firewall and terminate the process.
   • CReboot the system to clear the process from memory, then check if it reappears.
   • DCapture the process's network connections and memory, then analyze the binary's code signature and path.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   On a compromised macOS system, you find a process named 'update' running with high CPU usage. You need to determine if it is malicious. Which volatile artifact would provide the most useful information?

   • AThe system's volume settings
   • BThe process's parent process ID and command-line arguments
   • CThe system's uptime
   • DThe user's desktop wallpaper
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During an incident, you need to identify which process on a macOS system is responsible for a suspicious outbound connection. Which command would provide the most direct answer?

   • A`ps aux`
   • B`lsof -i`
   • C`netstat -an`
   • D`top`
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You are responding to a macOS incident where a malicious process is hiding its network connections by using a rootkit. The system is running, and you have root access. Which technique would be most likely to reveal the hidden connections?

   • ACheck the system's firewall logs
   • BUse the same network tool multiple times to see if results change
   • CReboot the system and then check network connections
   • DCompare the output of standard network tools with raw socket data from the kernel
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During an incident, you find a process that is listening on a high-numbered port and has no associated binary on disk. The process is running as root. What is the most likely explanation?

   • AThe process is malware that injected code into a legitimate process and is listening for incoming connections.
   • BThe process is a temporary process spawned by the system for a maintenance task.
   • CThe process is a legitimate system service that was loaded from a kernel extension.
   • DThe process is a user application that was deleted while running.
   Reveal Solution Discussion Select an answer first