Scenario practice questions

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

Trap 1: Worm

A worm is self-replicating malware that spreads across networks, but it does not usually encrypt files or demand ransom. Worms can cause network disruption, but the scenario's encrypted files and ransom note point to ransomware. Thus, worm is not the correct classification for this incident.

Trap 2: Trojan

A Trojan is malware disguised as legitimate software, but it does not typically encrypt files or display a ransom note. Trojans often provide backdoor access or steal data. While a Trojan could deliver ransomware, the scenario directly describes ransomware behavior, not the initial disguise. Therefore, Trojan is not the most specific answer.

Trap 3: Rootkit

A rootkit is designed to hide the presence of other malware or provide persistent privileged access, but it does not encrypt files or display ransom notes. Rootkits operate stealthily, whereas ransomware is overt in its demands. The scenario clearly indicates ransomware, not a rootkit.

A
Worm
Why it fails: A worm is self-replicating malware that spreads across networks, but it does not usually encrypt files or demand ransom. Worms can cause network disruption, but the scenario's encrypted files and ransom note point to ransomware. Thus, worm is not the correct classification for this incident.
B
Ransomware
Ransomware is a type of malware that encrypts files on a victim's system and demands payment for the decryption key. The scenario of encrypted files and a ransom note is the classic hallmark of a ransomware attack. Splunk ES can detect ransomware through indicators such as file encryption events, ransom note creation, and unusual process executions.
C
Trojan
Why it fails: A Trojan is malware disguised as legitimate software, but it does not typically encrypt files or display a ransom note. Trojans often provide backdoor access or steal data. While a Trojan could deliver ransomware, the scenario directly describes ransomware behavior, not the initial disguise. Therefore, Trojan is not the most specific answer.
D
Rootkit
Why it fails: A rootkit is designed to hide the presence of other malware or provide persistent privileged access, but it does not encrypt files or display ransom notes. Rootkits operate stealthily, whereas ransomware is overt in its demands. The scenario clearly indicates ransomware, not a rootkit.

Question 2mediummultiple choice

An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?

Trap 1: Web

The Web data model contains HTTP traffic details like URLs, methods, and status codes. It is useful for web attack investigations but does not log file system changes. The .locky file modifications are endpoint events, so the Web data model cannot provide the necessary visibility into file operations.

Trap 2: Network_Traffic

The Network_Traffic data model focuses on network flow data, such as bytes transferred, source and destination IPs, and ports. While it can detect anomalous traffic patterns, it does not contain file system events like file modifications or extensions. It would not help identify .locky file changes on shared drives.

Trap 3: Authentication

The Authentication data model captures login and logout events, including user, src, and dest. It is used for detecting brute force or credential misuse, but it does not track file system activities. Ransomware file modifications would not appear in authentication logs, making this model irrelevant for the scenario.

A
Web
Why it fails: The Web data model contains HTTP traffic details like URLs, methods, and status codes. It is useful for web attack investigations but does not log file system changes. The .locky file modifications are endpoint events, so the Web data model cannot provide the necessary visibility into file operations.
B
Endpoint.Filesystem
The Endpoint.Filesystem data model tracks file creation, modification, and deletion events from endpoint data sources. It includes fields like file_name, file_path, and action, which are essential for identifying the sudden appearance of files with a specific extension like .locky, a known ransomware indicator. This model is designed for endpoint file activity monitoring.
C
Network_Traffic
Why it fails: The Network_Traffic data model focuses on network flow data, such as bytes transferred, source and destination IPs, and ports. While it can detect anomalous traffic patterns, it does not contain file system events like file modifications or extensions. It would not help identify .locky file changes on shared drives.
D
Authentication
Why it fails: The Authentication data model captures login and logout events, including user, src, and dest. It is used for detecting brute force or credential misuse, but it does not track file system activities. Ransomware file modifications would not appear in authentication logs, making this model irrelevant for the scenario.

Question 3mediummulti select

Which TWO of the following are common types of social engineering?

Trap 1: Buffer Overflow

Buffer Overflow is a memory-corruption software exploit, manipulating input length to overwrite adjacent memory, and involves no human persuasion. It is tempting because it is a common attack category, and it would be correct when identifying a vulnerability in an application that fails to validate input bounds.

Trap 2: SQL Injection

SQL Injection exploits unvalidated database query input to execute attacker-supplied statements; it targets code, not human trust. It is tempting because it appears frequently in attack lists, and it would be correct when assessing a web application's input handling rather than the manipulation of a person into revealing information.

Trap 3: Port Scanning

Port Scanning probes hosts for open TCP or UDP services and requires no interaction with a person, so it is a reconnaissance technique rather than social engineering. It is tempting because it precedes many intrusions, and it would be correct when mapping an external attack surface before exploitation.

A
Buffer Overflow
Why it fails: Buffer Overflow is a memory-corruption software exploit, manipulating input length to overwrite adjacent memory, and involves no human persuasion. It is tempting because it is a common attack category, and it would be correct when identifying a vulnerability in an application that fails to validate input bounds.
B
SQL Injection
Why it fails: SQL Injection exploits unvalidated database query input to execute attacker-supplied statements; it targets code, not human trust. It is tempting because it appears frequently in attack lists, and it would be correct when assessing a web application's input handling rather than the manipulation of a person into revealing information.
C
Pretexting
Pretexting fabricates a scenario or identity to manipulate a target into divulging information or performing actions, exploiting trust rather than technical flaws. It is a recognised social engineering category, satisfying the stem's requirement for common human-focused manipulation techniques.
D
Phishing
Phishing uses fraudulent messages impersonating trusted entities to trick recipients into revealing credentials or clicking malicious links, exploiting human trust rather than technical vulnerabilities. It is a core social engineering category, satisfying the stem's requirement for common manipulation techniques.
E
Port Scanning
Why it fails: Port Scanning probes hosts for open TCP or UDP services and requires no interaction with a person, so it is a reconnaissance technique rather than social engineering. It is tempting because it precedes many intrusions, and it would be correct when mapping an external attack surface before exploitation.

Question 4hardmultiple choice

An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?

Trap 1: Watering hole attack

A watering hole attack compromises a website frequented by a target group to deliver malware. Like drive-by downloads, it does not involve Office applications directly spawning PowerShell. The observed process lineage is characteristic of macro-based execution, not a watering hole. Thus, this choice is incorrect for the given scenario.

Trap 2: Supply chain compromise

A supply chain compromise involves injecting malware into legitimate software or updates. It does not match the scenario of an Office application launching encoded PowerShell. While supply chain attacks can lead to code execution, the specific parent-child process relationship here is a hallmark of malicious macros, not supply chain injection.

Trap 3: Drive-by download

A drive-by download occurs when a user visits a compromised website and malware is automatically downloaded. It does not typically involve Microsoft Office spawning PowerShell. The scenario explicitly shows an Office application as the parent process, which points to macro execution rather than a browser-based drive-by download. Therefore, this technique is not the best fit.

A
Watering hole attack
Why it fails: A watering hole attack compromises a website frequented by a target group to deliver malware. Like drive-by downloads, it does not involve Office applications directly spawning PowerShell. The observed process lineage is characteristic of macro-based execution, not a watering hole. Thus, this choice is incorrect for the given scenario.
B
Phishing with a malicious macro
Microsoft Office applications spawning PowerShell with encoded commands is a common indicator of a malicious macro. Attackers use macros to execute PowerShell, often with base64-encoded payloads to evade detection. This technique is frequently used in phishing campaigns. Splunk ES can detect this by monitoring process creation events where the parent is an Office app and the child is PowerShell with suspicious arguments.
C
Supply chain compromise
Why it fails: A supply chain compromise involves injecting malware into legitimate software or updates. It does not match the scenario of an Office application launching encoded PowerShell. While supply chain attacks can lead to code execution, the specific parent-child process relationship here is a hallmark of malicious macros, not supply chain injection.
D
Drive-by download
Why it fails: A drive-by download occurs when a user visits a compromised website and malware is automatically downloaded. It does not typically involve Microsoft Office spawning PowerShell. The scenario explicitly shows an Office application as the parent process, which points to macro execution rather than a browser-based drive-by download. Therefore, this technique is not the best fit.

Question 5mediummultiple choice

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

Trap 1: T1110 - Brute Force

T1110 Brute Force involves attempting to guess passwords or cryptographic keys through repeated attempts. It does not describe the use of already-compromised valid credentials, which is the core of the scenario. Brute force is a technique for obtaining credentials, not for using them to access accounts stealthily, so it is not the correct mapping here.

Trap 2: T1059 - Command and Scripting Interpreter

T1059 Command and Scripting Interpreter covers abuse of command-line interfaces and scripting languages to execute commands. While often used after obtaining valid accounts, it does not define the initial access or lateral movement via legitimate credentials. The scenario specifically highlights credential use, not interpreter execution, making this technique a less accurate mapping.

Trap 3: T1021 - Remote Services

T1021 Remote Services describes using remote services like RDP or SSH to move laterally, but it requires valid accounts to do so. The scenario is about the use of legitimate credentials themselves, not the specific remote service abused. Therefore, T1021 is a sub-technique or follow-on action, not the primary technique describing the credential usage.

A
T1078 - Valid Accounts
T1078 Valid Accounts describes adversaries obtaining and using credentials of existing accounts to gain access, escalate privileges, and move laterally. It is a precise match because the scenario emphasizes legitimate credentials, which are often undetected by traditional defenses. Mapping to this technique helps analysts focus on anomalous account usage rather than exploit-based intrusions.
B
T1110 - Brute Force
Why it fails: T1110 Brute Force involves attempting to guess passwords or cryptographic keys through repeated attempts. It does not describe the use of already-compromised valid credentials, which is the core of the scenario. Brute force is a technique for obtaining credentials, not for using them to access accounts stealthily, so it is not the correct mapping here.
C
T1059 - Command and Scripting Interpreter
Why it fails: T1059 Command and Scripting Interpreter covers abuse of command-line interfaces and scripting languages to execute commands. While often used after obtaining valid accounts, it does not define the initial access or lateral movement via legitimate credentials. The scenario specifically highlights credential use, not interpreter execution, making this technique a less accurate mapping.
D
T1021 - Remote Services
Why it fails: T1021 Remote Services describes using remote services like RDP or SSH to move laterally, but it requires valid accounts to do so. The scenario is about the use of legitimate credentials themselves, not the specific remote service abused. Therefore, T1021 is a sub-technique or follow-on action, not the primary technique describing the credential usage.

Question 6mediummultiple choice

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

Trap 1: Edit the risk rule's stanza in `risk_rules.conf` and set the…

While risk scores are configured in risk rules, the direct file is `savedsearches.conf` with risk stanza settings, and editing it globally lowers the score for all users, not just this one. The analyst wants to reduce the impact for a specific user scenario without affecting other detections. This approach is too broad and may weaken detection elsewhere.

Trap 2: Modify the user's risk score manually in the Risk Analysis…

Risk scores are derived from risk events and are not manually editable in the Risk Analysis dashboard. There is no supported subtract-points action that permanently adjusts an entity's score. Any manual change would be overwritten as new risk events arrive, so this does not solve the underlying repeated-firing issue.

Trap 3: Change the user's risk object type in the identity lookup so the…

The identity lookup maps users to identities and does not control risk rule matching. Changing a risk object type there would not stop the rule from firing, and it could break other correlations that rely on accurate identity data. This is not a valid method for reducing risk score inflation.

A
Create a risk rule exception or a throttling configuration for the rule so it does not repeatedly add risk for the same user within a time window.
Throttling or exception logic prevents a risk rule from repeatedly contributing risk for the same entity in a short period. This directly addresses the repeated firing on benign activity for this user while keeping the rule active for other entities. It is the targeted approach that reduces score inflation without disabling detection.
B
Edit the risk rule's stanza in `risk_rules.conf` and set the `risk_score` value to a lower number.
Why it fails: While risk scores are configured in risk rules, the direct file is `savedsearches.conf` with risk stanza settings, and editing it globally lowers the score for all users, not just this one. The analyst wants to reduce the impact for a specific user scenario without affecting other detections. This approach is too broad and may weaken detection elsewhere.
C
Modify the user's risk score manually in the Risk Analysis dashboard by subtracting points from the current total.
Why it fails: Risk scores are derived from risk events and are not manually editable in the Risk Analysis dashboard. There is no supported subtract-points action that permanently adjusts an entity's score. Any manual change would be overwritten as new risk events arrive, so this does not solve the underlying repeated-firing issue.
D
Change the user's risk object type in the identity lookup so the rule no longer matches the user.
Why it fails: The identity lookup maps users to identities and does not control risk rule matching. Changing a risk object type there would not stop the rule from firing, and it could break other correlations that rely on accurate identity data. This is not a valid method for reducing risk score inflation.

Question 7easymultiple choice

A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?

Trap 1: signature

The 'signature' field contains the name of the correlation search that generated the event, such as 'Excessive Failed Logins'. It is static and does not vary based on the specific incident details. Therefore, it cannot help differentiate between a brute-force attack and a misconfigured service account.

Trap 2: dest

The 'dest' field indicates the target server. It is useful for scoping the affected asset but does not provide insight into whether the activity is malicious or benign. Both brute-force and misconfiguration can target the same server, so this field alone does not help distinguish the cause.

Trap 3: src

The 'src' field shows the source IP of the failed logins. While a single external IP might suggest brute-force, a misconfigured service could also originate from a single internal IP. Without knowing the user, the source alone does not definitively differentiate between the two scenarios, as both can originate from a single source.

A
signature
Why it fails: The 'signature' field contains the name of the correlation search that generated the event, such as 'Excessive Failed Logins'. It is static and does not vary based on the specific incident details. Therefore, it cannot help differentiate between a brute-force attack and a misconfigured service account.
B
dest
Why it fails: The 'dest' field indicates the target server. It is useful for scoping the affected asset but does not provide insight into whether the activity is malicious or benign. Both brute-force and misconfiguration can target the same server, so this field alone does not help distinguish the cause.
C
user
The 'user' field identifies the account being targeted. If it is a service account, misconfiguration is likely; if it is a regular user or many different users, brute-force is more probable. Examining the user helps distinguish between an attack and an operational issue, making it the most relevant field for this differentiation.
D
src
Why it fails: The 'src' field shows the source IP of the failed logins. While a single external IP might suggest brute-force, a misconfigured service could also originate from a single internal IP. Without knowing the user, the source alone does not definitively differentiate between the two scenarios, as both can originate from a single source.