Hard — 350-201 Practice Quiz

Question 1

During dynamic analysis of a suspicious executable, an analyst notices that the sample runs briefly, performs no observable network or file activity, and then exits cleanly in the sandbox. However, endpoint telemetry from an infected production host shows extensive persistence and C2 traffic from the same binary. Which conclusion best explains this discrepancy, and what is the appropriate next step?

Accepted Answer

The malware employs anti-analysis/VM-evasion techniques and detected the sandbox; the analyst should modify the environment to defeat evasion checks or use bare-metal analysis before drawing conclusions.

Answer

The sandbox produced a false negative due to insufficient run time; simply re-run the sample with a longer detonation timeout to capture the behavior.

Answer

The production infection is unrelated to this binary; the analyst should discard the sample as benign since the sandbox showed no malicious activity.

Answer

The static analysis phase was skipped; the analyst should submit the file hash to a threat intelligence feed instead of performing any further behavioral analysis.

Question 2

During analysis of a suspicious Windows executable, an analyst runs a static examination and finds almost no readable strings, high section entropy, and an unusually small import table containing only LoadLibrary and GetProcAddress. Dynamic execution in the sandbox shows the process allocating a large region of memory marked RWX and then jumping into it. Which conclusion and next step best fit these findings?

Accepted Answer

The sample is packed/obfuscated; dump the process memory after it unpacks itself at runtime, then perform static analysis on the extracted payload.

Answer

The sample is benign because it has too few imports to perform malicious activity; close the case.

Answer

The sample is a corrupted binary; regenerate the hash and re-download it before continuing analysis.

Answer

The sample uses only network-based behavior; skip memory analysis and rely solely on captured PCAP indicators.

Question 3

A SOC analyst reviews a critical unpatched vulnerability (CVSS 9.1) on a legacy manufacturing control server. The vendor no longer supports the operating system, and applying the upstream OS patch would break the proprietary application that must remain in production. What is the most appropriate patching recommendation for this asset?

Accepted Answer

Isolate the server behind network segmentation and apply compensating controls until a supported migration path is available

Answer

Immediately apply the upstream OS patch during the next maintenance window regardless of application impact

Answer

Accept the risk with no action since no vendor patch exists for the application

Answer

Uninstall the proprietary application so the OS can be patched normally

Question 4

A SOC analyst is investigating potential data loss from a SaaS collaboration platform. The alert indicates that a large volume of files was downloaded from a corporate cloud storage account over the weekend, but the corporate identity provider logs show no interactive sign-in events from the affected user during that window. Which investigative action should the analyst prioritize to determine how the data was accessed?

Accepted Answer

Review the OAuth application grants and API access tokens authorized on the account to identify third-party or malicious app access bypassing interactive login

Answer

Reimage the user's corporate laptop to remove any malware responsible for the downloads

Answer

Reset the user's Active Directory password and force a domain-wide password change

Answer

Increase the retention period on the endpoint DLP agent to capture future exfiltration attempts

Question 5

An analyst detonates a suspicious executable in an automated sandbox. The report shows the sample writes a randomly named DLL to %AppData%, creates a registry Run key, then contacts three different domains that each resolve to the same IP block and use identical TLS certificate serial numbers. The analyst wants to produce a durable, high-fidelity detection artifact that will still match future variants of this malware family even if the file hash changes. Which action produces the most effective complex indicator?

Accepted Answer

Create a composite behavioral indicator correlating the AppData DLL drop, the Run key persistence, and the shared TLS certificate serial into a single rule

Answer

Add each observed domain and the file's SHA-256 hash individually to the blocklist as atomic indicators

Answer

Extract the sandbox VM's memory dump and store it as the primary detection reference

Answer

Record the sandbox execution timestamp and CPU usage as the indicator baseline

Question 6

A malware sample is detonated in an automated sandbox. The behavioral report shows the process spawning svchost.exe, writing a file to %AppData%, and making outbound DNS queries to hundreds of pseudo-random hostnames (e.g., xkjdlqwe.biz, plmqoazx.net) before one resolves and an HTTPS session begins. Which artifact from this run is the MOST useful host-based Indicator of Compromise (IOC) for detecting the same infection on other endpoints?

Accepted Answer

The file hash and registry/file path written under %AppData%

Answer

The pseudo-random DNS query hostnames observed in the sandbox capture

Answer

The specific IP address the successful HTTPS session connected to

Answer

The observation that the process spawned svchost.exe

Question 7

A vulnerability scanner reports a critical flaw (CVSS Base score 9.1) on 40 servers across the enterprise. During triage, the SOC analyst discovers that 35 of these servers are internal-only development boxes containing no sensitive data, while 5 are internet-facing systems processing customer financial transactions. Company policy requires prioritizing remediation using industry scoring systems. What should the analyst do to most accurately re-prioritize these findings for risk analysis?

Accepted Answer

Apply the CVSS Environmental metric group to adjust scores based on each asset's confidentiality, integrity, and availability requirements and modified attack surface

Answer

Treat all 40 servers as equal priority since they share the same 9.1 Base score and patch them in the order they were discovered

Answer

Recalculate the CVSS Base score for each server to lower the values on the development boxes

Answer

Use only the CVSS Temporal metrics to reflect current exploit maturity across all servers