I85PREP
⌘ K
Cisco 350-201 CBRCOR study materials
Cisco 350-201 CBRCOR study resources

Cisco 350-201 CBRCOR practice questions

One question at a time. Build your Cisco 350-201 CBRCOR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Core cybersecurity operations and threat analysis

During a security monitoring shift, an analyst receives an alert for a suspicious process lineage on a Windows endpoint: a Microsoft Word process spawned PowerShell. Which detection principle best explains why this alert is high-fidelity?

  1. It matches a known parent-child process relationship that is rare in legitimate business activity Correct answer.
  2. It proves that the user downloaded a malicious attachment from an external sender
  3. It confirms that the endpoint has an unpatched CVE that must be remediated immediately
  4. It indicates that the host is communicating with a known command-and-control server

Explanation

Process-lineage analytics compare parent and child process relationships against baselines of legitimate behavior. Word spawning PowerShell is uncommon in normal operations and often signals macro-based execution, so the alert is high-fidelity regardless of whether a CVE or C2 channel is confirmed.

Question 2Core cybersecurity operations and threat analysis

A SOC analyst is triaging an alert and wants to determine whether a file hash observed in an endpoint event has been previously reported by the security community. Which action most directly supports that determination?

  1. Query the hash in a threat intelligence platform for known malicious associations Correct answer.
  2. Review the firewall rule base for outbound traffic restrictions
  3. Inspect the endpoint's local administrator group membership
  4. Check the DHCP lease table for the host's IP assignment

Explanation

Threat intelligence platforms aggregate indicators and their reputations, so submitting a file hash is the direct way to learn whether it has been reported as malicious. The other actions address network policy, identity, or addressing and do not speak to hash reputation.

Question 3Core cybersecurity operations and threat analysis

Which data source is the most authoritative for identifying which user account authenticated to a domain controller and when?

  1. Endpoint antivirus scan history
  2. Windows Security event logs containing logon events Correct answer.
  3. NetFlow records collected at the network core
  4. Web proxy access logs

Explanation

Windows Security event logs record authentication events, including the account name, logon type, and source workstation, making them the authoritative source for domain authentication. Network flow, antivirus, and proxy logs may show related activity but do not record the authentication identity directly.

Question 4Core cybersecurity operations and threat analysis

An analyst observes an endpoint making periodic DNS queries to a domain that resolves to different IP addresses each day. Which analytic technique is most appropriate for detecting this behavior at scale?

  1. Block all outbound DNS traffic from the endpoint subnet
  2. Baseline the domain's IP diversity over time and alert on fast-flux patterns Correct answer.
  3. Manually resolve the domain once and compare it to a static allowlist
  4. Disable DNS logging to reduce storage costs

Explanation

Fast-flux domains rotate their resolved addresses to evade blocklists, so tracking IP diversity per domain over time is the analytic that surfaces the pattern. Static allowlists and single manual lookups cannot detect rotation, and disabling logging removes the evidence.

Question 5Core cybersecurity operations and threat analysis

A security team wants to detect lateral movement using remote service creation on Windows hosts. Which event pattern should the detection engineer focus on?

  1. Print spooler events showing a document printed to a network printer
  2. File share access events showing read operations by a service account
  3. Group Policy refresh events showing policy application on a workstation
  4. Service control manager events showing a new service installed with a suspicious binary path Correct answer.

Explanation

Remote service creation is typically recorded by the service control manager when a new service is installed, and the binary path often reveals the payload. Share reads, print jobs, and policy refreshes are normal operations that do not indicate service-based execution.

Question 6Core cybersecurity operations and threat analysis

An analyst is reviewing a suspicious email reported by a user. Which artifact best supports determining whether the message originated from the claimed sender domain?

  1. The message's displayed sender name in the mail client
  2. The message's subject line formatting
  3. The message's attachment file extension
  4. The message's authentication results headers showing SPF, DKIM, and DMARC outcomes Correct answer.

Explanation

SPF, DKIM, and DMARC results in the authentication headers indicate whether the sending infrastructure was authorized for the claimed domain. Display names, subject lines, and attachment extensions can be crafted freely and do not establish origin.

Question 7Core cybersecurity operations and threat analysis

Which approach best describes threat hunting as practiced in a mature security operations center?

  1. Reviewing firewall change requests for policy compliance
  2. Running scheduled vulnerability scans against production systems
  3. Waiting for automated alerts and closing them in queue order
  4. Proactively searching telemetry for behaviors tied to a hypothesis about adversary activity Correct answer.

Explanation

Threat hunting is a hypothesis-driven, proactive search through available telemetry for evidence of adversary behavior that existing detections may have missed. Alert triage, vulnerability scanning, and change review are important but are reactive or compliance-oriented rather than hunting.

Question 8Core cybersecurity operations and threat analysis

During incident triage, an analyst needs to determine the scope of a suspected credential compromise across the enterprise. Which investigative step is most directly useful?

  1. Review the endpoint's installed software inventory for outdated applications
  2. Examine the web proxy logs for large file downloads by any user
  3. Check the physical access control logs for badge entries to the data center
  4. Search authentication logs for successful logons by the affected account from unusual source hosts Correct answer.

Explanation

Scoping a credential compromise requires finding where the account authenticated successfully and whether source hosts deviate from the norm. Software inventory, download volume, and badge logs do not establish use of the compromised credential.

Question 9Core cybersecurity operations and threat analysis

An analyst observes a host resolving a long, high-entropy subdomain of a domain the organization does not own, repeated every 30 seconds. Which technique does this most likely indicate?

  1. Fast-flux hosting used to rotate malicious web servers
  2. DNS tunneling used for command-and-control or data exfiltration Correct answer.
  3. Domain fronting used to hide traffic behind a CDN
  4. Typosquatting used to lure users to a lookalike site

Explanation

High-entropy, long subdomains queried at a regular cadence to an unowned domain are characteristic of DNS tunneling, where data is encoded in the query name. Fast flux concerns rotating IP answers, domain fronting concerns TLS SNI versus Host mismatch, and typosquatting concerns lookalike domains visited by users.

Question 10Core cybersecurity operations and threat analysis

A detection engineer wants to reduce false positives from a rule that alerts on any PowerShell execution. Which refinement is most appropriate?

  1. Increase the alert severity to critical for all PowerShell events
  2. Add conditions for encoded commands, download cradles, or suspicious parent processes Correct answer.
  3. Disable the rule and rely on endpoint antivirus signatures
  4. Suppress the rule for all hosts in the server subnet

Explanation

Tuning a noisy rule means narrowing it to behaviors that correlate with malicious use, such as encoded commands, download cradles, or anomalous parent processes. Raising severity, disabling the rule, or blanket suppression reduces detection value without improving precision.

Question 11Core cybersecurity operations and threat analysis

Which indicator type is most durable for tracking an adversary campaign over months, given that attackers frequently rotate infrastructure?

  1. A domain registered two weeks ago for a phishing campaign
  2. A file hash of a payload variant seen once
  3. A single IP address observed in one command-and-control session
  4. Behavioral tactics and techniques mapped to a framework such as MITRE ATT&CK Correct answer.

Explanation

Behavioral techniques persist across infrastructure changes because adversaries must still accomplish the same objectives, making them durable for long-term tracking. IPs, recently registered domains, and single-variant hashes are easily changed and have short useful lifetimes.

Question 12Core cybersecurity operations and threat analysis

An analyst is investigating a suspected data exfiltration event and finds large outbound transfers to an unfamiliar external IP over HTTPS. Which additional data source best helps distinguish exfiltration from legitimate cloud backup traffic?

  1. The switch's spanning tree topology
  2. The endpoint's BIOS version and firmware update history
  3. Proxy logs showing the destination hostname, user agent, and bytes transferred Correct answer.
  4. The domain controller's replication schedule

Explanation

Proxy logs add hostname, user agent, and transfer volume context that can separate sanctioned cloud backup from unauthorized exfiltration. Firmware history, switching topology, and replication schedules do not describe the destination or nature of the outbound transfer.

Question 13Core cybersecurity operations and threat analysis

A security analyst receives a malware sample and wants to determine its capabilities without executing it. Which approach fits this requirement?

  1. Run the sample on a production workstation and monitor for changes
  2. Execute the sample in the domain controller's administrative session
  3. Perform static analysis of strings, imports, and headers in an isolated analysis environment Correct answer.
  4. Submit the sample to the finance department for user testing

Explanation

Static analysis inspects the binary's strings, imports, and headers to infer capabilities without running the code, and it should be done in an isolated environment. Executing the sample on production systems or privileged sessions risks compromise.

Question 14Core cybersecurity operations and threat analysis

Which artifact from an endpoint investigation most directly reveals persistence established through the Windows registry?

  1. The endpoint's page file size
  2. The endpoint's ARP table
  3. The endpoint's DNS cache contents
  4. Autorun registry keys such as Run and RunOnce entries Correct answer.

Explanation

Run and RunOnce registry keys are common autostart locations that adversaries modify to persist across reboots. DNS cache, ARP tables, and page file size describe network state or memory configuration and do not establish persistence.

Question 15Core cybersecurity operations and threat analysis

During incident response, an analyst needs to preserve volatile evidence from a compromised host before shutdown. Which action is most appropriate?

  1. Immediately wipe the disk and reimage the host
  2. Capture memory and running process information before powering off the system Correct answer.
  3. Reboot the host to clear suspicious processes
  4. Delete temporary files to free disk space

Explanation

Volatile evidence such as memory contents and running processes is lost on shutdown or reboot, so it must be captured first. Wiping, deleting files, or rebooting destroys evidence needed for root-cause analysis.

Question 16Core cybersecurity operations and threat analysis

An analyst notices a spike in failed authentication attempts against many accounts from a single source followed by a successful logon. Which activity does this pattern most likely represent?

  1. Normal morning logon activity across the enterprise
  2. A Kerberos ticket renewal by a workstation
  3. Password spraying followed by a successful credential compromise Correct answer.
  4. A scheduled service account rotation

Explanation

Many failed attempts across different accounts from one source indicate password spraying, and a subsequent success suggests a valid credential was found. Normal logons, service account rotation, and ticket renewal do not produce broad failure spikes followed by success.

Question 17Core cybersecurity operations and threat analysis

Which characteristic most distinguishes a command-and-control beacon from ordinary periodic application traffic?

  1. High-bandwidth streaming to a well-known content delivery network
  2. Regular intervals with jitter and small, consistent payload sizes to an uncommon destination Correct answer.
  3. Connections that use the organization's internal DNS resolvers exclusively
  4. Traffic that occurs only during scheduled backup windows

Explanation

Beacons typically check in at regular intervals with added jitter and exchange small, consistent payloads with infrastructure that is uncommon in the environment. High-bandwidth CDN streaming, backup-window traffic, and use of internal resolvers are normal patterns.

Question 18Core cybersecurity operations and threat analysis

An analyst wants to verify whether a suspicious binary is signed by a trusted publisher. Which artifact should be checked?

  1. The file's icon and version description strings
  2. The file's size in kilobytes
  3. The digital signature and certificate chain embedded in the executable Correct answer.
  4. The file's creation timestamp alone

Explanation

Authenticode signatures and their certificate chains establish whether a binary was signed by a trusted publisher and whether the signature is valid. Timestamps, file size, and descriptive strings can be forged or manipulated and do not verify publisher identity.

Question 19Core cybersecurity operations and threat analysis

A detection rule fires on access to the LSASS process by a non-standard tool. Which technique does this most likely indicate?

  1. Credential dumping from process memory Correct answer.
  2. Golden ticket forgery
  3. Pass-the-hash authentication
  4. Kerberoasting of service account tickets

Explanation

LSASS stores credential material in memory, so unusual process access to LSASS is a hallmark of credential dumping tools. Kerberoasting, pass-the-hash, and golden tickets involve ticket or hash abuse rather than direct LSASS memory access.

Question 20Core cybersecurity operations and threat analysis

Which practice best supports reproducible threat hunting across multiple analysts?

  1. Relying on individual analysts' memory of past investigations
  2. Restricting all hunting to ad hoc console commands
  3. Disabling logging on endpoints to reduce noise during hunts
  4. Documenting hypotheses, data sources, and queries so findings can be replayed and reviewed Correct answer.

Explanation

Documented hypotheses, data sources, and queries make hunts reproducible, reviewable, and transferable between analysts. Relying on memory, ad hoc commands, or disabling logging undermines consistency and evidence quality.

Question 21Core cybersecurity operations and threat analysis

An analyst observes that a compromised host communicates with an internal server on TCP 445 during off-hours, and the server then contacts multiple other hosts on the same port. Which behavior is most consistent with this pattern?

  1. Email-based phishing delivery to internal users
  2. DNS exfiltration through internal resolvers
  3. Outbound HTTPS beaconing to external infrastructure
  4. SMB-based lateral movement from an initial foothold Correct answer.

Explanation

SMB on TCP 445 is used for file sharing and remote execution, and a fan-out of connections from one host to many others is consistent with lateral movement. DNS exfiltration, external HTTPS beaconing, and phishing delivery do not match internal SMB fan-out.

Question 22Core cybersecurity operations and threat analysis

Which factor most affects the fidelity of a signature-based detection rule in a large enterprise?

  1. The physical location of the security operations center
  2. The specificity of the pattern relative to legitimate software in the environment Correct answer.
  3. The number of analysts assigned to the shift
  4. The color scheme of the analyst dashboard

Explanation

Signature fidelity depends on how uniquely the pattern identifies malicious activity versus legitimate software common in the environment. Dashboard design, staffing, and facility location affect operations but not the rule's detection accuracy.

Question 23Core cybersecurity operations and threat analysis

A security analyst is asked to enrich an alert involving an unfamiliar autonomous system number (ASN). Which enrichment step is most relevant?

  1. Inspect the local firewall's default deny rule
  2. Review the organization's password complexity policy
  3. Look up the ASN's owning organization, hosting type, and reputation in threat intelligence Correct answer.
  4. Check the endpoint's disk encryption status

Explanation

ASN enrichment reveals the owning organization, whether it is a hosting or residential provider, and its reputation, which helps assess whether the destination is suspicious. Encryption status, password policy, and local firewall rules do not describe the remote network.

Question 24Core cybersecurity operations and threat analysis

An analyst is comparing two alerts: one from an endpoint detection tool and one from a network intrusion detection system. Which statement best describes how these sources complement each other during investigation?

  1. Endpoint telemetry captures all encrypted traffic contents while network telemetry captures only metadata
  2. Endpoint telemetry provides process and file context while network telemetry provides connection and protocol context Correct answer.
  3. Both sources record identical fields and one can always replace the other
  4. Network telemetry identifies the exact user account while endpoint telemetry identifies the destination ASN

Explanation

Endpoint and network telemetry observe different layers, with endpoints providing process, file, and user context and networks providing connection and protocol context. Neither source captures encrypted payload contents by default, and their fields are not interchangeable.

Question 25Core cybersecurity operations and threat analysis

A threat intelligence report describes an adversary using living-off-the-land binaries. Which detection strategy is most appropriate for this threat?

  1. Rely solely on file hash blocklists for known malware families
  2. Monitor command-line arguments and parent processes of legitimate system utilities for anomalous use Correct answer.
  3. Disable command-line logging to reduce log volume
  4. Block all execution of signed Microsoft binaries on endpoints

Explanation

Living-off-the-land attacks abuse legitimate signed utilities, so detection depends on anomalous command-line arguments and parent-child relationships rather than file reputation. Hash blocklists miss these binaries, blocking all signed Microsoft binaries breaks operations, and disabling logging removes the evidence.

Question 26Core cybersecurity operations and threat analysis

A SOC analyst receives an alert about a suspicious process on a Windows host. The analyst wants to determine the process's parent-child relationship and command-line arguments. Which data source is most appropriate?

  1. NetFlow records
  2. Sysmon Event ID 1 Correct answer.
  3. DNS server logs
  4. Windows Security Event ID 4624

Explanation

Sysmon Event ID 1 captures process creation events, including the image, command line, parent process, and user context, which directly answer the analyst's questions. Security Event ID 4624 logs logon events, not process details. NetFlow and DNS logs provide network-level information but not process lineage.

Question 27Core cybersecurity operations and threat analysis

An analyst is triaging a possible phishing incident and needs to extract the originating IP address and mail transfer path from an email. Which email header field should be examined?

  1. Subject
  2. Message-ID
  3. Content-Type
  4. Received Correct answer.

Explanation

The Received header fields are added by each mail transfer agent and show the path the message took, including IP addresses of relays. Subject and Message-ID do not reliably indicate origin, and Content-Type only describes the message body format.

Question 28Core cybersecurity operations and threat analysis

Which term describes the process of assigning indicators of compromise to a campaign or threat actor based on shared infrastructure and tactics?

  1. Enrichment
  2. Normalization
  3. Attribution Correct answer.
  4. Correlation

Explanation

Attribution is the analytical judgment that links observed activity to a specific actor or campaign. Enrichment adds context to individual indicators, correlation finds relationships among events, and normalization standardizes data formats.

Question 29Core cybersecurity operations and threat analysis

An analyst needs to determine whether a suspicious domain was recently registered, which is a common indicator of malicious infrastructure. Which data source provides this information?

  1. TLS certificate transparency logs
  2. Passive DNS
  3. BGP routing tables
  4. WHOIS registration records Correct answer.

Explanation

WHOIS records include the domain creation date, allowing the analyst to assess domain age. Passive DNS shows historical resolutions, certificate transparency logs list issued certificates, and BGP tables show routing, but none of these directly provide the registration date.

Question 30Core cybersecurity operations and threat analysis

During incident response, an analyst needs to identify which user account was used to create a scheduled task on a Windows host. Which log source is most likely to contain this information?

  1. Windows Application Event ID 1000
  2. Windows Security Event ID 4698 Correct answer.
  3. Windows Security Event ID 1102
  4. Windows System Event ID 7036

Explanation

Security Event ID 4698 is generated when a scheduled task is created and includes the subject user and task details. Event ID 1102 indicates the audit log was cleared, 7036 reports service state changes, and 1000 is an application crash event.

Question 31Core cybersecurity operations and threat analysis

Which protocol and port are most commonly associated with command-and-control traffic that blends in with normal web browsing?

  1. RDP over TCP 3389
  2. SMB over TCP 445
  3. HTTPS over TCP 443 Correct answer.
  4. DNS over UDP 53

Explanation

Adversaries frequently use HTTPS on TCP 443 for command and control because it is widely allowed and encrypted, helping traffic blend with normal web activity. DNS tunneling, SMB, and RDP are also used but are more likely to be restricted or monitored in a way that exposes them.

Question 32Core cybersecurity operations and threat analysis

An analyst is reviewing a packet capture and wants to identify the application-layer protocol used for name resolution. Which Wireshark display filter should be applied?

  1. arp
  2. http
  3. dns Correct answer.
  4. tls

Explanation

The dns display filter shows DNS traffic, which is the protocol used for name resolution. HTTP, TLS, and ARP serve different purposes and do not resolve domain names.

Question 33Core cybersecurity operations and threat analysis

Which security control is designed to detect and block malicious traffic by comparing it against known attack patterns?

  1. Vulnerability scanner
  2. Intrusion prevention system Correct answer.
  3. Security information and event management
  4. Endpoint detection and response

Explanation

An intrusion prevention system inspects traffic and blocks it when it matches known attack signatures. SIEM aggregates and correlates logs, EDR focuses on endpoint behavior, and vulnerability scanners assess weaknesses rather than block traffic.

Question 34Core cybersecurity operations and threat analysis

An analyst is reviewing a suspicious PowerShell command that downloads and executes a script from a remote URL. Which PowerShell feature is most directly relevant to detecting this behavior?

  1. Execution policy
  2. Module autoloading
  3. Transcription
  4. Script block logging Correct answer.

Explanation

Script block logging records the content of PowerShell script blocks, including those that are obfuscated or dynamically generated, making it valuable for detecting malicious commands. Module autoloading and execution policy affect how PowerShell runs but do not log script content, and transcription captures console input and output but may miss internal script blocks.

Question 35Core cybersecurity operations and threat analysis

A threat intelligence feed provides a list of IP addresses associated with a botnet. Which action should the SOC take to reduce false positives before blocking these addresses at the perimeter?

  1. Block all listed addresses immediately
  2. Share the list with the media
  3. Add the addresses to the allowlist
  4. Validate the indicators against internal telemetry and reputation services Correct answer.

Explanation

Indicators should be validated against internal logs and multiple reputation sources to confirm relevance and reduce false positives before enforcement. Immediate blocking without validation risks disrupting legitimate services, allowlisting is the opposite of the intended action, and sharing externally may violate policy.

Question 36Core cybersecurity operations and threat analysis

An analyst observes repeated DNS queries for random-looking subdomains of a single domain, with each query returning a different IP address. Which technique is most likely being used?

  1. Fast flux
  2. Typosquatting
  3. DNS tunneling
  4. Domain generation algorithm Correct answer.

Explanation

A domain generation algorithm produces many pseudo-random domain names that malware cycles through to locate its command-and-control server. Fast flux rotates IP addresses for a single domain, DNS tunneling encodes data in queries, and typosquatting registers misspelled domains to impersonate brands.

Question 37Core cybersecurity operations and threat analysis

An analyst is investigating a suspected lateral movement event and sees a successful SMB connection from a workstation to a server using a domain administrator account. Which log source best confirms the authentication?

  1. DNS server logs
  2. Domain controller security logs Correct answer.
  3. Firewall logs
  4. Workstation system logs

Explanation

Domain controller security logs record authentication events such as Kerberos ticket requests and account logons, which confirm whether the domain administrator account authenticated. Firewall logs show connection attempts, workstation system logs do not record domain authentication, and DNS logs show name resolution.

Question 38Core cybersecurity operations and threat analysis

Which artifact is most useful for determining whether a Windows executable was recently executed on a host?

  1. Event log files
  2. Prefetch files Correct answer.
  3. Registry hives
  4. Pagefile

Explanation

Prefetch files are created when an executable runs and contain the executable name, run count, and last run time. Registry hives and event logs can contain related evidence but are not as direct, and the pagefile is a memory backing store.

Question 39Core cybersecurity operations and threat analysis

An analyst is reviewing a malware sandbox report and sees that the sample created a mutex named 'Global\MsWinZonesCacheCounterMutexA'. What does this mutex most likely indicate?

  1. The malware is ensuring only one instance runs Correct answer.
  2. The malware is encrypting files
  3. The malware is exfiltrating data
  4. The malware is establishing persistence

Explanation

Mutants (mutexes) are commonly used by malware to prevent multiple instances from running simultaneously. Encryption, persistence, and exfiltration are separate behaviors not indicated by the mutex name alone.

Question 40Core cybersecurity operations and threat analysis

Which technique is used by adversaries to hide malicious code within a legitimate process to evade detection?

  1. Process hollowing Correct answer.
  2. Phishing
  3. Brute force
  4. Watering hole

Explanation

Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, and resuming it, which can evade process-based detection. Phishing and watering hole attacks are initial access vectors, and brute force is a password guessing technique.

Question 41Core cybersecurity operations and threat analysis

An analyst notices that a user account successfully authenticated from two geographically distant locations within a short time window. Which detection approach is most appropriate?

  1. Signature-based antivirus
  2. File integrity monitoring
  3. Vulnerability scanning
  4. Impossible travel analytics Correct answer.

Explanation

Impossible travel analytics correlates authentication events with geolocation and time to flag logins that cannot physically occur in the elapsed time. Antivirus, file integrity monitoring, and vulnerability scanning do not analyze authentication geolocation.

Question 42Core cybersecurity operations and threat analysis

Which factor most directly determines the retention period for security logs in an enterprise?

  1. Network bandwidth
  2. Regulatory and legal requirements Correct answer.
  3. Analyst preference
  4. Storage cost only

Explanation

Log retention is primarily driven by regulatory, legal, and contractual requirements, which specify minimum retention periods. Storage cost and analyst preference may influence implementation but are secondary, and network bandwidth is unrelated.

Question 43Core cybersecurity operations and threat analysis

An analyst is investigating a suspicious email attachment and wants to determine whether it contains a macro. Which file format is most likely to support macros?

  1. DOCM Correct answer.
  2. PDF
  3. PNG
  4. TXT

Explanation

DOCM is a Microsoft Word macro-enabled document format, designed to store VBA macros. PDF, TXT, and PNG do not natively support VBA macros.

Question 44Core cybersecurity operations and threat analysis

An analyst has extracted a suspicious binary and wants to quickly identify whether it is packed. Which characteristic is most indicative of packing?

  1. Valid digital signature and version information
  2. High entropy in sections and few imported functions Correct answer.
  3. Presence of debug symbols
  4. Large file size and many strings

Explanation

Packed binaries typically have high-entropy sections because the original code is compressed or encrypted, and they often import few functions to hinder analysis. Large size with many strings, valid signatures, and debug symbols are more consistent with unpacked or legitimate software.

Question 45Core cybersecurity operations and threat analysis

An analyst needs to query a SIEM to find all failed logon events followed by a successful logon from the same source IP within five minutes. Which capability is most important for this task?

  1. Endpoint disk imaging
  2. Correlation rules with time windows Correct answer.
  3. Vulnerability scanning
  4. Full packet capture

Explanation

Correlation rules can join events across time windows and apply conditions such as failed-then-successful logons from the same source. Packet capture, disk imaging, and vulnerability scanning do not provide this event correlation capability.

Question 46Core cybersecurity operations and threat analysis

Which type of threat intelligence is most useful for proactively blocking known malicious domains before users visit them?

  1. Vulnerability advisories
  2. Indicator feeds Correct answer.
  3. Strategic reports
  4. Tactical playbooks

Explanation

Indicator feeds provide lists of malicious domains, IPs, and hashes that can be operationalized in security controls for blocking. Strategic reports inform decision-making, tactical playbooks describe adversary behavior, and vulnerability advisories describe software flaws.

Question 47Core cybersecurity operations and threat analysis

An analyst observes that a malware sample uses the Windows API function CreateRemoteThread. Which behavior does this most likely indicate?

  1. Network beaconing
  2. Process injection Correct answer.
  3. File encryption
  4. Registry persistence

Explanation

CreateRemoteThread is commonly used to inject code into another process by starting a thread in its address space. File encryption, registry persistence, and network beaconing use different APIs and behaviors.

Question 48Core cybersecurity operations and threat analysis

During a threat hunt, an analyst wants to identify hosts that are communicating with a known malicious IP address but has no direct indicator in the SIEM. Which approach is most appropriate?

  1. Disable the firewall
  2. Retrospective search of historical network logs Correct answer.
  3. Reimage all hosts
  4. Wait for an alert to fire

Explanation

A retrospective search of historical logs allows the analyst to find past communications with the malicious IP that may not have triggered an alert. Waiting is passive, disabling the firewall is harmful, and reimaging all hosts is disproportionate.

Question 49Core cybersecurity operations and threat analysis

An analyst is reviewing a memory dump and wants to identify injected code. Which artifact is most indicative of process injection?

  1. Executable memory regions not backed by a file on disk Correct answer.
  2. Presence of digital signatures
  3. High CPU usage
  4. Large number of open file handles

Explanation

Injected code often resides in memory regions that are executable but not mapped to a file on disk, which is anomalous for legitimate modules. High CPU usage, many open handles, and digital signatures are not specific indicators of injection.

Question 50Core cybersecurity operations and threat analysis

An analyst is investigating a suspected Kerberoasting attack. Which event is most indicative of this technique?

  1. A service ticket request with RC4 encryption for a service account Correct answer.
  2. A file share access by a regular user
  3. A DNS query for a domain controller
  4. A failed logon with bad password

Explanation

Kerberoasting involves requesting service tickets for service accounts and extracting the encrypted portion for offline cracking, often using RC4 encryption. Failed logons, DNS queries, and file share access are common and not specific to Kerberoasting.