200-201 exam dumps: questions 301 to 400 of 403

Correct answer: C

• A. Incorrect.

  While legitimate applications may scan a network, they typically operate in a controlled and predictable manner, not repeatedly targeting multiple destinations in a short timeframe.

• B. Incorrect.

  A DDoS attack usually involves multiple source IP addresses targeting a single destination, which is the opposite of the scenario described.

• C. Correct.

  This behavior is characteristic of a reconnaissance scan, where an attacker probes multiple devices in a network to gather information about potential vulnerabilities.

• D. Incorrect.

  A misconfigured device might cause unintended traffic, but it would not likely exhibit the systematic targeting of multiple destinations typical of a reconnaissance scan.

Correct answers: A, D

• A. Correct.

  Port 443 is the standard port for HTTPS, indicating that the server is hosting a secure service. This is a valid inference based on the server port identity.

• B. Incorrect.

  The use of a high-numbered port by the client does not necessarily indicate unauthorized activity. High-numbered ports are often ephemeral ports assigned dynamically for client connections.

• C. Incorrect.

  There is no inherent maliciousness in using a non-standard or high-numbered port. These ports are commonly used in legitimate communication.

• D. Correct.

  Clients typically use ephemeral (high-numbered) ports for initiating connections to servers, which aligns with the observed behavior of the client using port 56789.

Correct answer: A

• A. Correct.

  Correct: The server uses port 443, which is a well-known port for HTTPS, and the client uses an ephemeral port (a randomly assigned port above 1023) to establish the connection.

• B. Incorrect.

  Incorrect: The server uses a well-known port (443), but the client does not use a well-known port; it uses an ephemeral port.

• C. Incorrect.

  Incorrect: The client does not use a well-known port; it uses an ephemeral port, while the server uses a well-known port (443).

• D. Incorrect.

  Incorrect: The server uses a well-known port (443), not an ephemeral port, for the web service.

Correct answer: B

• A. Incorrect.

  Immediately terminating the process and deleting the associated file could result in losing important forensic evidence, making it harder to fully investigate the incident.

• B. Correct.

  Isolating the workstation ensures that the potentially malicious activity does not spread to other systems in the network. It also allows for further analysis of the process and registry modification attempts without risking additional damage.

• C. Incorrect.

  Allowing the process to continue running without first containing the system could lead to further compromise or spread of malicious activity across the network.

• D. Incorrect.

  Ignoring the activity is not a recommended action in a cybersecurity investigation, as it could lead to escalation of the threat or data loss.

Correct answer: B

• A. Incorrect.

  This is incorrect because the 'Run' registry key is not used for temporarily storing scripts. Deleting it immediately without further investigation could destroy evidence or cause system instability.

• B. Correct.

  This is correct because the 'Run' registry key is a legitimate location where programs are configured to execute at system startup. If an unknown or suspicious process is associated with it, further investigation is warranted to determine whether it is malicious.

• C. Incorrect.

  This is incorrect because the 'Run' registry key is not related to system updates. Ignoring the finding could allow the malware to persist on the system.

• D. Incorrect.

  This is incorrect because the 'Run' registry key does not manage user permissions. While analyzing user activity might be useful in some cases, it is not the appropriate action in this scenario.