Topic 08 Practice Test 1 covers Indicators of Malicious Activity for CompTIA Security+ SY0-701 and maps to objective 2.4: Given a scenario, analyze indicators of malicious activity. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
An architect working on a SOC investigation of suspicious activity needs one capability that provides malware designed to covertly collect information about users or systems and another that provides manipulation of path input to access files or directories outside an intended location. Which TWO selections are the best match? Choose TWO.
- Trojan
- Password brute force
- Privilege escalation
- Directory traversal
- Spyware
Correct Answers: D, E
Correct Answers
Answer D is correct because Directory traversal means manipulation of path input to access files or directories outside an intended location. This selection maps directly to one of the named needs. Privilege escalation addresses an attack that obtains permissions beyond those originally granted, so it does not satisfy the same slot.
Answer E is correct because Spyware means malware designed to covertly collect information about users or systems. This option satisfies a specific requirement in the stem; Password brute force serves systematically trying many password candidates against an account or captured hash and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality. The fixed-count answer set is Spyware, Directory traversal; this option does not fill one of those named functions. For example, Directory traversal is required for manipulation of path input to access files or directories outside an intended location.
Answer B is incorrect because Password brute force means systematically trying many password candidates against an account or captured hash. The fixed-count answer set is Spyware, Directory traversal; this option does not fill one of those named functions. For example, Directory traversal is required for manipulation of path input to access files or directories outside an intended location.
Answer C is incorrect because Privilege escalation means an attack that obtains permissions beyond those originally granted. The scenario calls for Spyware, Directory traversal. Selecting this option would leave one of those required functions uncovered. For example, Directory traversal is required for manipulation of path input to access files or directories outside an intended location.
Question 2
Which term describes malware designed to maintain privileged hidden access and conceal its presence?
- Rootkit
- Concurrent session anomaly
- Trojan
- Missing logs
Correct Answer: A
Correct Answer
Answer A is correct because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. The requirement maps directly to this function, whereas Missing logs is aimed at absence of expected telemetry or audit records.
Incorrect Answers
Answer B is incorrect because Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations. The scenario instead requires malware designed to maintain privileged hidden access and conceal its presence, which is why Rootkit is the better answer; this option serves the different function defined above.
Answer C is incorrect because Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality. The key mismatch is functional: Rootkit addresses malware designed to maintain privileged hidden access and conceal its presence, the need stated by the question.
Answer D is incorrect because Missing logs refers to absence of expected telemetry or audit records. The concept is valid, but it does not match this stem. The required function is malware designed to maintain privileged hidden access and conceal its presence, which maps to Rootkit.
Question 3
The control set for a SOC investigation of suspicious activity must address both self-propagating malware that spreads between systems without requiring a user to copy each instance and unexpected simultaneous use of the same identity from different devices or locations. Which TWO choices map directly to those needs? Choose TWO.
- Spyware
- Concurrent session anomaly
- Rootkit
- Worm
- Password spraying
Correct Answers: B, D
Correct Answers
Answer B is correct because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. The fixed-count item needs this function in the answer set. Rootkit covers malware designed to maintain privileged hidden access and conceal its presence, a different requirement.
Answer D is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. It belongs in the fixed-count answer set because it covers one of the stated requirements. Spyware instead serves malware designed to covertly collect information about users or systems and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Spyware means malware designed to covertly collect information about users or systems. The required choices are Concurrent session anomaly, Worm. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. Every answer slot must map to a stated requirement. The correct set is Concurrent session anomaly, Worm, so this option cannot replace one of those selections.
Answer E is incorrect because Password spraying means trying a small number of common passwords across many accounts. The fixed-count answer set is Concurrent session anomaly, Worm; this option does not fill one of those named functions. For example, Worm is required for self-propagating malware that spreads between systems without requiring a user to copy each instance.
Question 4
Two requirements remain open in a SOC investigation of suspicious activity: malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession; probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. Which TWO options close those specific gaps? Choose TWO.
- Out-of-cycle logging
- Directory traversal
- Collision attack
- Ransomware
- Birthday attack
Correct Answers: D, E
Correct Answers
Answer D is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. It belongs in the fixed-count answer set because it covers one of the stated requirements. Collision attack instead serves an attack that seeks two different inputs producing the same hash value and cannot replace this function.
Answer E is correct because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. This selection maps directly to one of the named needs. Directory traversal addresses manipulation of path input to access files or directories outside an intended location, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Out-of-cycle logging means security-relevant activity recorded at an unusual time compared with normal operational patterns. Every answer slot must map to a stated requirement. The correct set is Birthday attack, Ransomware, so this option cannot replace one of those selections.
Answer B is incorrect because Directory traversal means manipulation of path input to access files or directories outside an intended location. The fixed-count answer set is Birthday attack, Ransomware; this option does not fill one of those named functions.
Answer C is incorrect because Collision attack means an attack that seeks two different inputs producing the same hash value. The required choices are Birthday attack, Ransomware. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 5
Which term describes malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure?
- DDoS reflection
- DNS attack
- Privilege escalation
- Ransomware
Correct Answer: B
Correct Answer
Answer B is correct because DNS attack means malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. The requirement maps directly to this function, whereas Ransomware is aimed at malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.
Incorrect Answers
Answer A is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. This could be appropriate elsewhere, but the required function is malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure; that makes DNS attack the precise choice.
Answer C is incorrect because Privilege escalation refers to an attack that obtains permissions beyond those originally granted. This could be appropriate elsewhere, but the required function is malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure; that makes DNS attack the precise choice.
Answer D is incorrect because Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. The scenario instead requires malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure, which is why DNS attack is the better answer; this option serves the different function defined above.
Question 6
Which term describes manipulation of path input to access files or directories outside an intended location?
- Injection attack
- DDoS amplification
- Impossible travel
- Directory traversal
Correct Answer: D
Correct Answer
Answer D is correct because Directory traversal means manipulation of path input to access files or directories outside an intended location. That is the function the question is testing. Injection attack would instead be used for an application attack that causes untrusted input to be interpreted as commands, queries, or code.
Incorrect Answers
Answer A is incorrect because Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code. That concept can be valid in another scenario, but this question is testing manipulation of path input to access files or directories outside an intended location; Directory traversal therefore fits the requirement more directly.
Answer B is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The key mismatch is functional: Directory traversal addresses manipulation of path input to access files or directories outside an intended location, the need stated by the question.
Answer C is incorrect because Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. That concept can be valid in another scenario, but this question is testing manipulation of path input to access files or directories outside an intended location; Directory traversal therefore fits the requirement more directly.
Question 7
Which application attack causes untrusted input to be interpreted as commands, queries, or code?
- Virus
- Injection attack
- Impossible travel
- Directory traversal
Correct Answer: B
Correct Answer
Answer B is correct because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. This matches the requirement as written. Impossible travel can be valid in another context, but it is used for an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.
Incorrect Answers
Answer A is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. This could be appropriate elsewhere, but the required function is an application attack that causes untrusted input to be interpreted as commands, queries, or code; that makes Injection attack the precise choice.
Answer C is incorrect because Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. The concept is valid, but it does not match this stem. The required function is an application attack that causes untrusted input to be interpreted as commands, queries, or code, which maps to Injection attack.
Answer D is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. That concept can be valid in another scenario, but this question is testing an application attack that causes untrusted input to be interpreted as commands, queries, or code; Injection attack therefore fits the requirement more directly.
Question 8
Which term describes malware that attaches to a host file or other object and replicates when the infected host is executed?
- Out-of-cycle logging
- DDoS amplification
- Virus
- Password spraying
Correct Answer: C
Correct Answer
Answer C is correct because Virus means malware that attaches to a host file or other object and replicates when the infected host is executed. This matches the requirement as written. Out-of-cycle logging can be valid in another context, but it is used for security-relevant activity recorded at an unusual time compared with normal operational patterns.
Incorrect Answers
Answer A is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. The question is not asking for this function. It is testing malware that attaches to a host file or other object and replicates when the infected host is executed, so Virus is the stronger fit.
Answer B is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The concept is valid, but it does not match this stem. The required function is malware that attaches to a host file or other object and replicates when the infected host is executed, which maps to Virus.
Answer D is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. The scenario instead requires malware that attaches to a host file or other object and replicates when the infected host is executed, which is why Virus is the better answer; this option serves the different function defined above.
Question 9
Which term describes reuse of captured authentication data or tokens to impersonate a legitimate user or system?
- Collision attack
- Credential replay
- Rootkit
- Out-of-cycle logging
Correct Answer: B
Correct Answer
Answer B is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. This is the precise fit for the scenario. Out-of-cycle logging serves the different purpose of security-relevant activity recorded at an unusual time compared with normal operational patterns.
Incorrect Answers
Answer A is incorrect because Collision attack refers to an attack that seeks two different inputs producing the same hash value. The key mismatch is functional: Credential replay addresses reuse of captured authentication data or tokens to impersonate a legitimate user or system, the need stated by the question.
Answer C is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. That concept can be valid in another scenario, but this question is testing reuse of captured authentication data or tokens to impersonate a legitimate user or system; Credential replay therefore fits the requirement more directly.
Answer D is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. This could be appropriate elsewhere, but the required function is reuse of captured authentication data or tokens to impersonate a legitimate user or system; that makes Credential replay the precise choice.
Question 10
What is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing?
- On-path attack
- Password brute force
- Spyware
- DDoS reflection
Correct Answer: D
Correct Answer
Answer D is correct because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. This matches the requirement as written. Spyware can be valid in another context, but it is used for malware designed to covertly collect information about users or systems.
Incorrect Answers
Answer A is incorrect because On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic. This could be appropriate elsewhere, but the required function is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing; that makes DDoS reflection the precise choice.
Answer B is incorrect because Password brute force refers to systematically trying many password candidates against an account or captured hash. That concept can be valid in another scenario, but this question is testing a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing; DDoS reflection therefore fits the requirement more directly.
Answer C is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. That concept can be valid in another scenario, but this question is testing a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing; DDoS reflection therefore fits the requirement more directly.
Question 11
To recognize possible tampering, collection failure, or blind spots in monitoring, which security approach should be selected?
- DDoS reflection
- Password spraying
- Missing logs
- RFID cloning
Correct Answer: C
Correct Answer
Answer C is correct because Missing logs means absence of expected telemetry or audit records. The requirement maps directly to this function, whereas RFID cloning is aimed at copying or emulating data from an RFID credential.
Incorrect Answers
Answer A is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The question is not asking for this function. It is testing absence of expected telemetry or audit records, so Missing logs is the stronger fit.
Answer B is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. The key mismatch is functional: Missing logs addresses absence of expected telemetry or audit records, the need stated by the question.
Answer D is incorrect because RFID cloning refers to copying or emulating data from an RFID credential. The key mismatch is functional: Missing logs addresses absence of expected telemetry or audit records, the need stated by the question.
Question 12
Which term describes malicious code that remains dormant until a specific condition, event, or time triggers execution?
- Out-of-cycle logging
- Missing logs
- Logic bomb
- Worm
Correct Answer: C
Correct Answer
Answer C is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. This matches the requirement as written. Missing logs can be valid in another context, but it is used for absence of expected telemetry or audit records.
Incorrect Answers
Answer A is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. That concept can be valid in another scenario, but this question is testing malicious code that remains dormant until a specific condition, event, or time triggers execution; Logic bomb therefore fits the requirement more directly.
Answer B is incorrect because Missing logs refers to absence of expected telemetry or audit records. The concept is valid, but it does not match this stem. The required function is malicious code that remains dormant until a specific condition, event, or time triggers execution, which maps to Logic bomb.
Answer D is incorrect because Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance. That concept can be valid in another scenario, but this question is testing malicious code that remains dormant until a specific condition, event, or time triggers execution; Logic bomb therefore fits the requirement more directly.
Question 13
Two requirements remain open in a SOC investigation of suspicious activity: attack in which an adversary positions itself between communicating parties to observe or alter traffic; application attack that causes untrusted input to be interpreted as commands, queries, or code. Which TWO options close those specific gaps? Choose TWO.
- Injection attack
- On-path attack
- Password brute force
- Worm
- Collision attack
Correct Answers: A, B
Correct Answers
Answer A is correct because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. This selection maps directly to one of the named needs. Worm addresses self-propagating malware that spreads between systems without requiring a user to copy each instance, so it does not satisfy the same slot.
Answer B is correct because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic. This selection maps directly to one of the named needs. Worm addresses self-propagating malware that spreads between systems without requiring a user to copy each instance, so it does not satisfy the same slot.
Incorrect Answers
Answer C is incorrect because Password brute force means systematically trying many password candidates against an account or captured hash. The required choices are Injection attack, On-path attack. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. The fixed-count answer set is Injection attack, On-path attack; this option does not fill one of those named functions.
Answer E is incorrect because Collision attack means an attack that seeks two different inputs producing the same hash value. Every answer slot must map to a stated requirement. The correct set is Injection attack, On-path attack, so this option cannot replace one of those selections.
Question 14
Which attack seeks two different inputs producing the same hash value?
- DDoS amplification
- Collision attack
- Rootkit
- Trojan
Correct Answer: B
Correct Answer
Answer B is correct because Collision attack means an attack that seeks two different inputs producing the same hash value. The requirement maps directly to this function, whereas Rootkit is aimed at malware designed to maintain privileged hidden access and conceal its presence.
Incorrect Answers
Answer A is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The scenario instead requires an attack that seeks two different inputs producing the same hash value, which is why Collision attack is the better answer; this option serves the different function defined above.
Answer C is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. That concept can be valid in another scenario, but this question is testing an attack that seeks two different inputs producing the same hash value; Collision attack therefore fits the requirement more directly.
Answer D is incorrect because Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality. The concept is valid, but it does not match this stem. The required function is an attack that seeks two different inputs producing the same hash value, which maps to Collision attack.
Question 15
To impersonate a physical-access badge or other RFID token, which security approach should be selected?
- Missing logs
- Concurrent session anomaly
- DDoS reflection
- RFID cloning
Correct Answer: D
Correct Answer
Answer D is correct because RFID cloning means copying or emulating data from an RFID credential. This matches the requirement as written. Missing logs can be valid in another context, but it is used for absence of expected telemetry or audit records.
Incorrect Answers
Answer A is incorrect because Missing logs refers to absence of expected telemetry or audit records. The concept is valid, but it does not match this stem. The required function is copying or emulating data from an RFID credential, which maps to RFID cloning.
Answer B is incorrect because Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations. The concept is valid, but it does not match this stem. The required function is copying or emulating data from an RFID credential, which maps to RFID cloning.
Answer C is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The key mismatch is functional: RFID cloning addresses copying or emulating data from an RFID credential, the need stated by the question.
Question 16
Reviewers working through a SOC investigation of suspicious activity identify three separate needs: malware designed to covertly collect information about users or systems; malware designed to maintain privileged hidden access and conceal its presence; probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. Which THREE choices map to those needs? Choose THREE.
- Credential replay
- Trojan
- Injection attack
- Spyware
- Rootkit
- Birthday attack
Correct Answers: D, E, F
Correct Answers
Answer D is correct because Spyware means malware designed to covertly collect information about users or systems. This option satisfies a specific requirement in the stem; Credential replay serves reuse of captured authentication data or tokens to impersonate a legitimate user or system and therefore is not interchangeable with it.
Answer E is correct because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. This selection maps directly to one of the named needs. Trojan addresses malware that appears legitimate or useful but contains hidden malicious functionality, so it does not satisfy the same slot.
Answer F is correct because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The fixed-count item needs this function in the answer set. Trojan covers malware that appears legitimate or useful but contains hidden malicious functionality, a different requirement.
Incorrect Answers
Answer A is incorrect because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. The fixed-count answer set is Rootkit, Birthday attack, Spyware; this option does not fill one of those named functions.
Answer B is incorrect because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality. The scenario calls for Rootkit, Birthday attack, Spyware. Selecting this option would leave one of those required functions uncovered. For example, Spyware is required for malware designed to covertly collect information about users or systems.
Answer C is incorrect because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. Every answer slot must map to a stated requirement. The correct set is Rootkit, Birthday attack, Spyware, so this option cannot replace one of those selections.
Question 17
To recover or guess a credential through exhaustive attempts, which security approach should be selected?
- Password brute force
- Concurrent session anomaly
- Collision attack
- DDoS amplification
Correct Answer: A
Correct Answer
Answer A is correct because Password brute force means systematically trying many password candidates against an account or captured hash. This is the precise fit for the scenario. Collision attack serves the different purpose of an attack that seeks two different inputs producing the same hash value.
Incorrect Answers
Answer B is incorrect because Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations. This could be appropriate elsewhere, but the required function is systematically trying many password candidates against an account or captured hash; that makes Password brute force the precise choice.
Answer C is incorrect because Collision attack refers to an attack that seeks two different inputs producing the same hash value. The key mismatch is functional: Password brute force addresses systematically trying many password candidates against an account or captured hash, the need stated by the question.
Answer D is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. That concept can be valid in another scenario, but this question is testing systematically trying many password candidates against an account or captured hash; Password brute force therefore fits the requirement more directly.
Question 18
Which term describes copying or emulating data from an RFID credential?
- RFID cloning
- Spyware
- Directory traversal
- Logic bomb
Correct Answer: A
Correct Answer
Answer A is correct because RFID cloning means copying or emulating data from an RFID credential. That makes it the best answer here; Directory traversal addresses manipulation of path input to access files or directories outside an intended location, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. The scenario instead requires copying or emulating data from an RFID credential, which is why RFID cloning is the better answer; this option serves the different function defined above.
Answer C is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. This could be appropriate elsewhere, but the required function is copying or emulating data from an RFID credential; that makes RFID cloning the precise choice.
Answer D is incorrect because Logic bomb refers to malicious code that remains dormant until a specific condition, event, or time triggers execution. The key mismatch is functional: RFID cloning addresses copying or emulating data from an RFID credential, the need stated by the question.
Question 19
To identify unusually large attack traffic generated from small spoofed requests, which security approach should be selected?
- DDoS reflection
- Birthday attack
- DDoS amplification
- Keylogger
Correct Answer: C
Correct Answer
Answer C is correct because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. This is the precise fit for the scenario. Birthday attack serves the different purpose of a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Incorrect Answers
Answer A is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The concept is valid, but it does not match this stem. The required function is a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim, which maps to DDoS amplification.
Answer B is incorrect because Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. This could be appropriate elsewhere, but the required function is a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim; that makes DDoS amplification the precise choice.
Answer D is incorrect because Keylogger refers to software or hardware that records keystrokes. The scenario instead requires a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim, which is why DDoS amplification is the better answer; this option serves the different function defined above.
Question 20
A review during a SOC investigation of suspicious activity identifies two gaps. One requires malware designed to covertly collect information about users or systems. The other requires malicious code that remains dormant until a specific condition, event, or time triggers execution. Which TWO options should be included in the remediation plan? Choose TWO.
- Missing logs
- Spyware
- Rootkit
- Logic bomb
- Concurrent session anomaly
Correct Answers: B, D
Correct Answers
Answer B is correct because Spyware means malware designed to covertly collect information about users or systems. This selection maps directly to one of the named needs. Concurrent session anomaly addresses unexpected simultaneous use of the same identity from different devices or locations, so it does not satisfy the same slot.
Answer D is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. This option satisfies a specific requirement in the stem; Missing logs serves absence of expected telemetry or audit records and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Missing logs means absence of expected telemetry or audit records. Every answer slot must map to a stated requirement. The correct set is Spyware, Logic bomb, so this option cannot replace one of those selections.
Answer C is incorrect because Rootkit means malware designed to maintain privileged hidden access and conceal its presence. Every answer slot must map to a stated requirement. The correct set is Spyware, Logic bomb, so this option cannot replace one of those selections.
Answer E is incorrect because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. The scenario calls for Spyware, Logic bomb. Selecting this option would leave one of those required functions uncovered.
