Tools that find malicious activity

Key: A

1. ACorrect: A Snort-style NIDS rule has a header (action, protocol, addresses, ports, direction) and options in parentheses (content matches, message, SID, and other criteria).
2. BRules describe what to match in a packet, but 'packet' is not a section of the rule.
3. CRules have no footer section; everything after the header is the options block.
4. D'TCP rules' is not a rule component; TCP is just one protocol value that can appear in the header.

Key: D

1. Aifconfig shows and configures network interfaces; it does not capture traffic.
2. Bnetstat lists connections, listening ports, and statistics, but it does not capture packet contents.
3. Cping tests whether a host is reachable with ICMP echo requests; it does not capture traffic.
4. DCorrect: tcpdump captures live packets from an interface and can save them to a pcap file with -w for later analysis.

Key: B

1. ASYN followed by any ACK is a loose rule; a session is established only after the full SYN, SYN/ACK, ACK sequence, not just any ACK.
2. BCorrect: Flows 2 and 4 both complete the three-way handshake (SYN, SYN/ACK, ACK), and Flow 4 then carries data with PSH/ACK.
3. CPacket count is not the test; a flow could have three packets without completing the handshake.
4. DEvery flow starts with a SYN, including Flow 1 (no reply) and Flow 3 (reset), so a SYN alone proves nothing.

Key: D

1. A-size matches files by size and ignores when they were modified.
2. B-name matches files by name pattern and says nothing about modification time.
3. C-type matches by file type, such as regular file or directory.
4. DCorrect: -mtime -7 matches files whose content was modified less than 7 days ago.

Key: D

1. Anetstat -ano is the Windows form; it shows the owning process ID but not the program name, and Linux netstat does not use -o that way.
2. B-v only makes the output more verbose; it does not map connections to programs.
3. C-s prints per-protocol statistics and lists no individual connections.
4. DCorrect: On Linux, -n shows numeric addresses, -a shows all sockets, and -p adds the PID and program name that owns each connection.

Key: A

1. ACorrect: flow analysis looks at metadata such as addresses, ports, protocols, timing and byte counts, without opening packet payloads.
2. BHeuristic analysis judges behavior or code against rules of thumb, and it often needs to inspect content.
3. CSignature-based detection matches known patterns, usually inside packet payloads, so it does examine the data.
4. DPacket analysis captures and decodes full packets, payload included, the opposite of what the stem describes.

Key: A

1. ACorrect: Hashing, string extraction, PE header review, and checks for packing are static steps that run nothing, so they are the safe first pass before any detonation.
2. BRunning the file in a debugger is dynamic analysis, which the scenario says comes later.
3. CPatching import tables modifies the sample, and entropy is calculated from the file itself; 'dynamic execution entropy' is not a static triage step.
4. DA disassembler does not execute a binary, and dropped files only exist after execution, so this sequence assumes the file has already run.

Key: C

1. ABlocking egress and allowing only local DNS is a safe configuration and leaves no gap.
2. BRedirecting outbound traffic to a logged internal sinkhole is a recommended practice, so it is no gap.
3. CCorrect: Without egress controls or sinkholing, the sample can reach real C2 servers, alert the attacker, download more payloads, or attack other systems.
4. DRunning the sample with admin rights and logging file writes is common in a sandbox; it is not the gap that lets malware reach live C2.

Key: D

1. AHigh confidence is right, but waiting for user confirmation delays containment that the evidence already justifies.
2. BSeveral independent signals agree, so low confidence understates the evidence, and more AV scans add little.
3. CAV detections, a YARA match to known C2, and real callbacks are more than medium confidence, and monitoring alone lets the threat continue.
4. DCorrect: Independent signals that agree, AV detections, a YARA C2 match, and observed callbacks, give high confidence, so the next step is isolating the affected host.

Key: A

1. ACorrect: Passive DNS shows which IPs and domains the indicator has resolved to over time, which quickly links the new domain to related campaign infrastructure.
2. BWHOIS gives registration details only, which can be privacy-protected or fake, and has no resolution history.
3. CPassive DNS is not slower than WHOIS, and speed is not the reason to choose either one.
4. DStopping after WHOIS leaves infrastructure links unknown, which is exactly what a campaign investigation needs.

Key: C

1. AIsolating the workstation before confirming the alert can disrupt a legitimate user, and the alert concerns a sign-in, not necessarily a compromised workstation.
2. BA password reset is a reasonable containment step only after the alert is validated; doing it first may respond to a false positive.
3. CCorrect: Impossible travel alerts often come from VPNs, proxies, or outdated GeoIP data, so the first step is to confirm the location data is accurate before acting.
4. DEscalating before basic validation sends possible false positives to the response team.

Key: C

1. ANetFlow has no user-agent strings, and vulnerability scan output does not show C2 activity.
2. BDNS logs do not contain user-agent strings, and WHOIS describes domains without saying which internal hosts are compromised.
3. CCorrect: Proxy logs show which hosts sent the suspicious user-agent, and EDR process telemetry then confirms which process on each host made the request.
4. DFirewall logs lack HTTP user-agent data, and SIEM alerts depend on rules that may not yet cover this string.

Key: A

1. ACorrect: The bracket expression [abc] matches exactly one of a, b, or c, so the pattern matches error-a, error-b, and error-c.
2. B^ anchors to the start of a line, so placing it in the middle of the pattern does not create a character set.
3. C$ anchors to the end of a line, and inside double quotes the shell may expand $abc as a variable, so this does not match the three strings.
4. D* repeats the preceding character zero or more times; it does not choose between a, b, and c.

Key: D

1. A& is not the pipeline operator; in PowerShell it is the call operator, and a trailing & starts a background job in PowerShell 7.
2. B> redirects output to a file, so this would write to a file named Sort-Object instead of passing objects to the cmdlet.
3. C>> appends output to a file instead of passing it to another command.
4. DCorrect: The pipe | sends the objects from Get-Process into Sort-Object, which sorts them by CPU.

Key: A

1. ACorrect: The EDR, network IDS, and sandbox results agree with each other, and a clean AV verdict is expected for a novel polymorphic sample, so the combined evidence justifies escalation.
2. BSignature-based AV is weakest against novel polymorphic malware, because the signature does not exist yet.
3. CMedium-confidence EDR alerts should be correlated with other evidence instead of being dismissed because one scanner found nothing.
4. DA clean AV result cannot prove that a high-confidence IDS hit to a known C2 IP is a false positive.