uC 003 Malicious Activity

Nick wants to analyze a potentially malicious software package using an open-source, locally hosted tool. Which of the following tools is best suited to his need if he wants to run the tool as part of the process?

• Cuckoo Sandbox

• SIEM 

• EDR

• VirusTotal

Answer explanation

Automated malware analysis with Cuckoo Sandbox

Cynthia wants to build scripts to detect malware beaconing behavior. Which of the following is not a means of identifying malware beaconing behavior for building scripts on a network?

• Beaconing interval

• Removal of known traffic

• Beacon protocol

• Persistence of the beaconing

Answer explanation

A beacon protocol is not a means of identifying malware beaconing behavior for building scripts on a network. Unless Cynthia already knows the protocol that a particular beacon uses, filtering out beacons by protocol may cause her to miss beaconing behavior. Attackers want to dodge common analytical tools and will use protocols that are less likely to attract attention.

Henry wants to identify potentially unauthorized scheduled tasks on a Linux system. What Linux command is most useful to identify scheduled tasks?

• cron

• chmod

• ps

• ls

Answer explanation

The cron command is used to set, view, and maintain scheduled tasks in Linux. Scheduled tasks, or cron jobs in Linux, are also a popular method for attackers to maintain persistent access to systems. Checking for unexpected scheduled tasks (or cron jobs) is a common part of incident response processes.

Angela wants to search for rogue devices on her network. Which of the following techniques will best help her identify systems if she has a complete hardware and systems inventory?

• Traffic analysis for unexpected behavior

• MAC address verification

• MAC address vendor checking

• Site surveys

Answer explanation

Since Angela already knows the media access control (MAC) addresses of all the devices due to her systems inventory, she can simply search for associated MAC addresses that do not match the list.

Ian wants to provide additional email security for his organization. Which of the following is not used to enhance email security?

• DKIM

• DMARC

• S/PDIF

• SPF

Answer explanation

Automated malware analysis with Cuckoo Sandbox

Which of the following is not a common network issue?

• Beaconing

• Bandwidth consumption

• Unexpected traffic

• Link aggregation

Brian works in an XYZ organization. His network suddenly stops working at 8:40 AM, interrupting video conferences, streaming, and other services throughout his organization, and then resumes functioning. When Brian logs into his Paessler Router Traffic Grapher (PRTG) console and checks his router's traffic via the primary connection's redundant network link, he sees the following graph. What should Brian presume occurred based on the given information shown in Figure A?

• The network has failed and is running in cached mode.

• PRTG stopped receiving flow information and needs to be restarted.

• 
  

  The primary link had gone down and he should check the secondary link for traffic.

• There was a link card failure and the card has recovered.

Answer explanation

PRTG

Cameron wants to check if a file matches a known-good original. What technique can he use to do so?

• Check the file size and creation date.

• Decrypt both the file and the original to compare them.

• Hash both the file and the original and compare the hashes.

• Use strings to compare the file content.

Juan wants to see a list of processes along with their CPU utilization in an interactive format. What built-in Linux tool should he use?

• cpugrep

• df

• top

• tail

Answer explanation

The top command in Linux provides an interactive interface to view central processing unit (CPU) utilization, memory usage, and other details for running processes. df shows the disk usage and tail displays the end of a file.

As part of her job, Danielle sets an alarm to notify her team via email if her Windows server uses 80 percent of its memory and to send a text message if it reaches 90 percent utilization. What is this setting called?

• Perfmon calibration

• Page monitoring

• A preset notification level

• A monitoring threshold