2.4 Given a scenario, analyze indicators of malicious activity

Domain 2: Threats, Vulnerabilities, and Mitigations

This is a scenario-heavy objective: given symptoms, identify the attack in progress. Cover malware indicators (ransomware, trojan, worm, spyware, bloatware, virus, keylogger, logic bomb, rootkit), physical attacks (brute force, RFID cloning), network attacks (DDoS including amplified and reflected, DNS attacks, wireless, on-path, credential replay, malicious code), application attacks (injection, buffer overflow, replay, privilege escalation, forgery, directory traversal), cryptographic attacks (downgrade, collision, birthday), and password attacks (spraying, brute force). Then learn the indicators themselves: account lockout, concurrent session usage, blocked content, impossible travel, resource consumption, resource inaccessibility, out-of-cycle logging, published or documented credentials, and missing logs. The exam pairs a log excerpt or behavior description with the attack name — one failed password against many accounts is spraying; encrypted files plus a ransom note is ransomware; logins from two continents an hour apart is impossible travel. Practice reading symptoms, not memorizing lists.

What you must know

common pitfall · Candidates confuse password spraying (one common password tried across many accounts) with brute force (many passwords hammered against one account).

Try a sample question

An analyst investigates a workstation generating thousands of DNS TXT queries per hour, each for a long, random-looking subdomain of the same registered external domain. Queries occur at fixed 30-second intervals, nearly all resolve successfully, and responses contain unusually large encoded payloads. Proxy logs show no corresponding web traffic. What is the MOST likely explanation?

  • A Malware using a domain generation algorithm to locate its command server
  • B A DNS amplification attack being launched from the workstation
  • C DNS cache poisoning redirecting the workstation's lookups
  • D DNS tunneling providing command-and-control and data exfiltration
Show answer & explanations
  • A DGA malware queries many different pseudo-random domains, most returning NXDOMAIN failures, until one registered domain answers; here every query targets a single domain and resolves successfully.
  • B DNS amplification is a denial-of-service technique that spoofs a victim's address toward open resolvers so large responses flood the victim; it would not show fixed-interval beacons carrying encoded subdomain data.
  • C Cache poisoning plants forged records in a resolver so legitimate names resolve to attacker addresses; it would not cause a victim host to generate thousands of random encoded subdomain queries.
  • D correct ·Correct. Encoding data into subdomain labels and receiving large TXT responses from a single attacker-controlled domain, on a regular beacon interval, is the signature of DNS tunneling for command-and-control and exfiltration.

sample item — the full bank runs 450+ questions at exam difficulty

Is objective 2.4 your weak spot?

The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.

Check my readiness — free