Attack Techniques GMON Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A security analyst is analyzing a suspicious executable in a sandbox. The analyst observes that the executable creates a file in the startup folder, modifies a registry Run key, and then attempts to connect to an external IP address on port 443. What is the most important indicator of compromise (IOC) to prioritize for detection across the enterprise?

   • AThe network connection to the external IP on port 443
   • BThe combination of persistence mechanisms and the outbound connection
   • CThe registry Run key modification
   • DThe file hash of the executable
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security team is planning its monitoring strategy for a network that includes both Windows and Linux systems. They have observed an increase in phishing attacks that deliver malicious Office documents. The team wants to implement a detection that covers both the initial delivery and the subsequent exploitation. Which approach best balances coverage and operational overhead?

   • ADeploy a network intrusion detection system (NIDS) to inspect all inbound email traffic.
   • BMonitor for outbound connections to known malicious IP addresses.
   • CImplement application whitelisting to block Office applications from running.
   • DEnable email gateway filtering for malicious attachments and monitor for Office applications spawning child processes.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A threat intelligence team is developing a detection content library. They have identified a new adversary group that uses a unique combination of techniques: initial access via phishing, defense evasion using process hollowing, and exfiltration over DNS. The team must prioritize which techniques to build detections for, given limited engineering resources. Which technique should be prioritized for detection development?

   • AProcess hollowing, because it is a distinctive TTP that may be less commonly seen in the environment.
   • BDNS exfiltration, because it is the final stage and stopping it prevents data loss.
   • CPhishing, because it is the initial access vector and blocking it prevents everything else.
   • DAll three techniques equally, because each is important.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which behavior is commonly associated with malware persistence mechanisms?

   • ADeleting itself after execution
   • BEncrypting network traffic to hide communication
   • CCreating a scheduled task to re-execute the malware
   • DScanning for open ports
   Reveal Solution Discussion Select an answer first