WorksheetsChapter 3: Malicious Activity
Total questions: 20
Worksheet time: 20mins
Which of the following Linux commands will show you how much disk space is in use?
top
df
lsof
ps
What Windows tool provides detailed information, including information about USB host controllers, memory usage, and disk transfers?
Statmon
Resmon
Perfmon
Winmon
What type of network information should you capture to be able to provide a report about how much traffic systems in your network sent to remote systems?
Syslog data
WMI data
Resmon data
Flow data
Which of the following technologies is best suited to prevent wired rogue devices from connecting to a network?
NAC
PRTG
Port security
NTP
As part of her job, Danielle sets an alarm to notify her team via email if her Windows server uses 80 percent of its memory and to send a text message if it reaches 90 percent utilization. What is this setting called?
A monitoring threshold
A preset notification level
Page monitoring
Perfmon calibration
Chris is reviewing a file that is part of an exploit package. He notes that there is a file that has content with curly brackets ({}) around statements. What file type from the following list he most likely reviewing?
Plain text
JSON
XML
HTML
What term describes a system sending heartbeat traffic to a botnet command-and-control server?
Beaconing
Zombie ping
CNCstatus
CNClog
Cameron wants to check if a file matches a known-good original. What technique can he use to do so?
Decrypt both the file and the original to compare them.
Use strings to compare the file content.
Hash both the file and the original and compare the hashes.
Check the file size and creation date.
What can the MAC address of a rogue device tell you?
Its operating system version
The TTL of the device
What type of rogue it is
The manufacturer of the device
How can Jim most effectively locate a wireless rogue access point that is causing complaints from employees in his building?
Nmap
Signal strength and triangulation
Connecting to the rogue AP
NAC
Which of the following tools does not provide real-time drive capacity monitoring for Windows?
Microsoft Configuration Manager
Resmon
SCOM
Perfmon
One of the business managers in Geeta's organization reports that she received an email with a link that appeared to be a link to the organization's HR website, and that the website it went to when she clicked on it was very similar to the organization's website. Fortunately, the manager noticed that the URL was different than usual. What technique best describes a link that is disguised to appear legitimate?
An obfuscated link
A symbolic link
A phishing link
A decoy link
Angela wants to review the syslog on a Linux system. What directory should she check to find it on most Linux distributions?
/home/log
/var/log
/log
/var/syslog
Laura wants to review headers in an email that one of her staff is suspicious of. What should she not have that person do if she wants to preserve the headers?
She shouldn't have them print the email.
She shouldn't have them reply to the email.
She shouldn't have them forward the email to her.
She shouldn't have them download the email.
Which of the following is a key differentiator between a SIEM and a SOAR?
A SIEM does not provide a dashboard.
A SOAR provides automated response capabilities.
A SOAR does not provide log aggregation.
A SIEM provides log analysis.
Which of the following options is not a valid way to check the status of a service in Windows?
Use sc at the command line.
Use service ––status at the command line.
Use services.msc.
Query service status using PowerShell.
Avik has been asked to identify unexpected traffic on her organization's network. Which of the following is not a technique she should use?
Protocol analysis
Heuristics
Baselining
Beaconing
Sofia suspects that a system in her datacenter may be sending beaconing traffic to a remote system. Which of the following is not a useful tool to help verify her suspicions?
Flows
A protocol analyzer
SNMP
An IDS or IPS
Susan wants to use an email security protocol to determine the authenticity of an email. Which of the following options will ensure that her organization's email server can determine if it should accept email from a sender?
DMARC
SPF
DKIM
POP3
Juan wants to see a list of processes along with their CPU utilization in an interactive format. What built-in Linux tool should he use?
df
top
tail
cpugrep
