Behavioral Analysis Fundamentals GREM Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An automated sandbox report for a malware sample shows that it performs a DNS query for 'malicious.com' and then connects to 'malicious.com' on port 8080. The report also shows that the malware sends a POST request with data that appears to be base64-encoded. Which finding is most indicative of data exfiltration?

   • AThe POST request with base64-encoded data
   • BThe connection to 'malicious.com' on port 8080
   • CThe use of a non-standard port (8080)
   • DThe DNS query for 'malicious.com'
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   When monitoring file system activity, which action would you flag as suspicious?

   • ACreating a legitimate document in the user's Documents folder
   • BModifying a system DLL file in the System32 directory
   • CReading a text file from the Desktop
   • DDeleting a temporary file after use
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An analyst is using Process Monitor to observe a malware sample. The analyst filters for 'Path' contains 'AppData' and sees that the malware creates a file named 'settings.ini' in the AppData\Roaming folder. The analyst also sees that the malware reads a file named 'config.dat' from the same folder. What is the most likely purpose of the 'settings.ini' file?

   • ATo serve as a decoy to mislead analysts.
   • BTo store the malware's persistence mechanism.
   • CTo log the malware's activities for debugging purposes.
   • DTo store configuration data that the malware uses during execution.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which element is essential to include in a structured behavioral analysis report?

   • AThe malware's source code
   • BA list of observed file, registry, process, and network activities
   • CThe analyst's personal opinion about the malware author
   • DThe malware's encryption keys
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An analyst is documenting the behavior of a banking trojan. The analyst observed that the malware creates a file named 'config.ini' in the %APPDATA% directory, modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run to point to the malware, and sends HTTP POST requests to a domain that is not associated with the bank. Which finding should be prioritized in the report as the most critical indicator of malicious intent?

   • AThe creation of 'config.ini' in %APPDATA%.
   • BThe modification of the Run registry key for persistence.
   • CThe file creation in %APPDATA% and registry modification together.
   • DThe HTTP POST requests to an unknown domain.
   Reveal Solution Discussion Select an answer first