CCFH-202b

Question 1

Refer to the exhibit.While investigating a process tree, you hover over a malicious powershell.exe process.What is the correct sequence of Process Actions?

1. 7 Network Operations4 Disk Operations61 DNS Requests2 Process Operations
2. 8 Network Operations61 Disk Operations4 DNS Requests2 Process Operations
3. 7 Network Operations4 Disk Operations8 DNS Requests
4. 61 Process Operations7 Network Operations4 Disk Operations61 DNS Requests8 Process Operations

Question 2

You want to hunt for the least-used Windows services that are starting from non-standard locations.Which query below will provide this information?

Question 3

Which hunting query's results could indicate that an adversary is performing reconnaissance from a specific host?

Question 4

You are investigating a process tree where WmiPrvSE launched PowerShell with the following command:What is this command doing?

1. Using PowerShell to perform a discovery scan of 172.17.0.21 on port 8080
2. Utilizing PowerShell to download a reverse shell from GitHub and executing it to create a connection
3. Utilizing PowerShell to force a connection to a reverse shell originating from Github

Question 5

Refer to the image.What line item of the query is used to perform outlier analysis?

1. Line 2
2. Line 3
3. Line 4
4. Line 6