Intrusion Triage and Analysis GSOC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An analyst is triaging an alert that a user's machine is sending large amounts of data to an external IP. The analyst checks the endpoint logs and sees that a backup application is running and is configured to send backups to a cloud storage provider. The external IP belongs to the cloud provider. However, the data volume is significantly higher than normal for this backup job. What is the most appropriate action?

   • AEscalate the alert because the data volume is abnormal.
   • BInvestigate the backup job's configuration and recent changes to determine if the data volume is expected.
   • CClose the alert because the backup application is legitimate.
   • DContain the machine to stop the data transfer immediately.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is triaging an alert that a user's machine has a file with a hash that matches a known malware sample. The analyst also sees that the file has not been executed and is located in the user's Downloads folder. The user is a known researcher who frequently downloads malware samples for analysis. What is the most appropriate action?

   • AQuarantine the file and notify the user's manager.
   • BContain the machine to prevent the malware from executing.
   • CClose the alert as a false positive after confirming the user's role and that the file has not been executed.
   • DEscalate the alert because the file is known malware.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst is triaging an alert that a user's machine made a connection to an IP address that is on a threat intel feed as a known C2 server. The analyst checks the endpoint logs and sees that the connection was made by a legitimate system process (svchost.exe). The process is running from the correct system path. Which conclusion is most appropriate?

   • AThe alert is a true positive because the IP is known malicious.
   • BThe analyst should investigate further to determine if the legitimate process is being abused or if the IP is misclassified.
   • CThe analyst should close the alert because the process is running from the correct path.
   • DThe alert is a false positive because the process is legitimate.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC analyst is triaging an alert that indicates a user visited a malicious URL. The proxy log shows the URL, but the endpoint logs show no infection. The analyst has access to DNS logs, EDR telemetry, and threat intelligence. Which combination of data sources would best confirm whether the visit resulted in an infection?

   • ADNS logs and threat intelligence
   • BThreat intelligence and proxy logs
   • CEDR telemetry and DNS logs
   • DEDR telemetry and threat intelligence
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During triage, an analyst sees an alert that a workstation downloaded a file with a SHA256 hash that matches a known malware signature. The analyst also observes that the file was executed and then made a DNS query for a domain that is not yet blocklisted. Which IOC type is most useful for confirming the alert as a true positive?

   • AThe file hash, because it is a definitive indicator of malware.
   • BThe file hash and the DNS query together, because they provide both static and behavioral evidence.
   • CThe file hash alone is sufficient, and the DNS query is irrelevant.
   • DThe DNS query, because it shows the malware is communicating with a command-and-control server.
   Reveal Solution Discussion Select an answer first