Host-Based Analysis (20%)

200-201 · 60 questions

• A hotel endpoint agent carries a signature for one malware family and a model that scores unusual parent-child process chains. Why does the agent keep both instead of relying on only one?
• At a university, a process on a lab PC begins accepting inbound connections from other hosts in the lab. Which control on that PC blocks those inbound connections?
• At a hospital, a clinical PC raises an alert after one process injects code into another process, and no known file hash was involved. Which endpoint technology fits the alert?
• At a manufacturer, an endpoint product scores a signed admin tool as suspicious because that tool's behavior is rare on the host, and no hash matched. What kind of detection produced the score?
• At a bank, outbound port 443 from a workstation is allowed, and a new listening port that a script just opened is denied. Which technology enforced that decision?
• At a retailer, a file on a register matches a known-bad hash, and the security product quarantines the file before it runs. Which technology performed that action?
• At a logistics hub, fileless malware is running inside a script host whose file hash matches the vendor signed binary. Which endpoint approach can still see that activity?
• On a bank workstation, Windows Security event 4625 records failed logons for an account and event 4624 is recorded for the same account just afterward. What does event 4624 add?
• On a university Windows host, event 1102 reports that the security audit log was cleared outside any maintenance window the team expected. Why does that event matter?
• On a hospital PC, Windows Security event 4688 records a new process after process-creation auditing was enabled so the event would exist. What does this event prove?
• On a retailer Windows host, event 7045 reports that a service was installed during the overnight window. Which item should the analyst inspect next on that same host?
• At an agency, a predictive endpoint model alerts on a help-desk remote-admin tool that staff launch on every working day. What is the right first reading of that alert?
• On an agency Linux jump host, a user's authorizedkeys file gains a public key line that the account owner did not add. What access does that new line create?
• At a SaaS company, Windows event 4720 shows that an account was created, and event 4732 shows that the same account was added to the local administrators group. What do these two events show together?
• On a Linux server at a logistics hub, a crontab entry for a warehouse account runs a downloader every hour. Which host component is that entry using?
• A manufacturer Linux host has a new systemd unit that starts a shell script at every boot, and the distribution authentication log shows no matching change ticket. What persistence mechanism is in front of the analyst?
• On a bank workstation, HKLM\Software\Microsoft\Windows\CurrentVersion\Run contains a new value pointing at a user-writable path. What does that value do?
• A hotel security console shows Windows event 4698 on a front-desk PC, recording that a scheduled task was created to run overnight. Which Windows component does that event describe?
• A hospital investigation can name the imaging server that was encrypted and cannot yet name who performed the encryption. Which attribution element is already known?
• An MSSP report names a criminal group as responsible for a customer incident solely from one IP address, and that address is a shared VPN exit. What is the correction?
• A university case file holds four notes: a stolen laptop, a group claim of responsibility, a file hash, and a sign-out sheet for the imaged drive. Which note is the chain of custody?
• At an agency, every person who handled a disk image signed the time they received it and the time they released it. What does that set of signatures document?
• At a bank, an analyst watches a help-desk tool spawn a shell and connect to a rare address while that activity is still underway, and no file hash has been published. What term fits this observation?
• After an incident at a retailer, responders publish a file hash and a callback domain found on a payment server. What term names those two artifacts?
• At a hotel, leadership wants the threat actor's legal name on the first day, but the only fact in hand is a foreign address on a consumer VPN. What can the analyst honestly report from that fact?
• At a retailer, a cashier was unhappy, and a register later had malware, but nothing ties that person to the file. What evidence class is the note about the unhappy cashier?
• At a manufacturer, a design file's hash matches a published indicator, and a process on the file server is spawning a script host right now. Which fact is the indicator of attack?
• At a bank, the original firewall log is still stored on the appliance, and the incident ticket holds a screenshot of that same log. Which item is best evidence of what the firewall recorded?
• At a hospital, an endpoint alert says a file hash ran, and the proxy log shows that same host fetched the file one minute earlier. What is the proxy log in relation to the endpoint alert?
• At a university, the host agent and the network log are independent sensors, and both show the same callback from one workstation. What is the relationship between those two records?
• At a manufacturer, an application log records an administrator export of the customer table at 02:00 from a workstation that has no night shift. What should the analyst do first?
• A hospital SOAR record says a playbook disabled a clinician account, but the directory still lists that same account as enabled. How should the analyst read the two records?
• At a logistics hub, a timeline note says the vendor was probably late and therefore the warehouse outage was an attack, but no log shows an intrusion. What evidence class is that note?
• Counsel for an agency demands the original disk from a seized workstation and will not accept the analyst's written notes about that disk. What evidence class is the original disk?
• At a university, shell history on a research host shows curl piping a script into a shell, followed by a new crontab line for that same account. What did this host record?
• A bank SIEM search on one account shows repeated Windows 4625 events and then a single 4624 from an address that account has not used before. What does this sequence show?
• At an agency, event 4624 records a successful logon for an ordinary user account, and event 4672 follows it showing special privileges assigned to that logon. What does event 4672 add?
• At a bank, the Linux authentication log shows repeated failures and then a success for an admin from a foreign address, and no change ticket exists for that logon. What is the first triage step?
• At a retailer, a register the real help desk does not use records Windows event 4720 for a new local account named helpdesk and event 4732 adding that account to the local Administrators group. What happened?
• At a SaaS company, a command-line log shows one process encoding a payload and starting a child process that opens an outbound connection. What does that host log support?
• At a hotel, the distribution authentication log shows a successful SSH login as a service account from the guest Wi-Fi range, and that account has previously been used only from the management VLAN. What is the lead?
• At a logistics hub, the SIEM shows Windows event 1102 on a warehouse PC and then no further security events from that PC. What is the best reading of those facts?
• At a hospital, the EHR application log shows a bulk chart read by a service account that has never read more than a few charts. Which question should the analyst ask first?
• At an MSSP, a customer ticket includes a SOAR log saying a host was isolated, yet that host still answers ping. What should the analyst do next?
• At a hotel, a front-desk Windows host records event 4740, an account lockout, after a burst of event 4625 failures from the guest VLAN. What do those events show?
• At a manufacturer, event 4698 records a new task whose action is a script in a temp directory, and event 4688 shows that script starting at the task time. What do the two events show together?
• At a retailer, event 4768 records a Kerberos ticket-granting-ticket request for a store manager, and event 4769 records a service ticket for a file share that manager never uses. What do those two events support?
• At a university, a student lab image has an empty shell history, and the distribution authentication log shows a command that cleared that history. What do those two records show?
• A manufacturer detonates a sample known to check for a sandbox, and the report shows no network connections and no new files. How should the analyst read that quiet result?
• An agency sandbox shows two samples that share a behavior description and have different hashes. What does that combination mean?
• A university sandbox URL list contains the campus update server and one newly registered domain. Which contact should the analyst treat as the lead?
• At a bank, a sandbox report lists a SHA-256 for the sample and no other section is filled in yet. What is that hash useful for at this point?
• At a hospital, a detonation report shows that a sample connected to three URLs and also created a run-key value. Which part of the report shows that network activity?
• A retailer sandbox report says the sample spawned a script host, wrote a file, and lists that file's hash. Which section of the report supports the process behavior?
• At a SaaS company, the same file hash appears in a sandbox detonation and on a build server that is supposed to hold only source code. What should the analyst ask first?
• A bank sandbox report shows a networking section with a connection to a rare IP address on port 443, plus a hash section that identifies the file. Which fact is the callback?
• An MSSP customer submits an office document. The sandbox opens it and reports no callbacks, and macros are disabled in the sandbox image. What limitation should the analyst record?
• A hospital sandbox report offers three usable lines: a file hash, a contacted URL, and a service the sample created. Which line is the host persistence artifact?
• A hotel sandbox report shows a dropped file and the hash of that drop, and a guest laptop still has a file with the same hash. What does that match establish?
• A logistics hub sandbox report lists file hashes, contacted URLs, and a process tree. Counsel asks for proof of what the sample did on the host, not merely the sample identity. Which report section answers that request?