312-39 · Question #57
The SOC analyst at a national cybersecurity agency detected unusual system behavior on critical infrastructure servers. Initial scans flagged potential malware activity. Due to the sophisticated…
The correct answer is D. Host integrity monitoring. Capturing and comparing system snapshots before and after suspected compromise is a core method of host integrity monitoring. The goal is to detect unauthorized changes to critical system components such as registry keys, scheduled tasks, services, binaries, configuration…
Question
The SOC analyst at a national cybersecurity agency detected unusual system behavior on critical infrastructure servers. Initial scans flagged potential malware activity. Due to the sophisticated nature of the suspected attack, including registry modifications, process injection, and unauthorized tasks, the case was escalated to the forensic team. The forensic team suspects the malware is designed for stealthy data exfiltration. To assess the compromise, they captured system snapshots before and after suspected infection to identify unauthorized changes and anomalies. Which process are they following by capturing and comparing system snapshots to detect unauthorized changes?
Options
- ADigital forensics
- BSignature-based detection
- CThreat intelligence gathering
- DHost integrity monitoring
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C8% (2)
- D80% (20)
Explanation
Capturing and comparing system snapshots before and after suspected compromise is a core method of host integrity monitoring. The goal is to detect unauthorized changes to critical system components such as registry keys, scheduled tasks, services, binaries, configuration files, and security settings. By comparing a known-good baseline snapshot to a suspected-compromised state, analysts can identify what changed, when it changed (with supporting timestamps), and which changes are anomalous relative to expected patching or administrative activity. While this activity can occur within a broader digital forensics investigation, the specific technique described-baseline comparison to detect unauthorized modification-is integrity monitoring. Signature-based detection focuses on matching known indicators (hashes, strings, known patterns) and does not rely on before/after snapshot comparison. Threat intelligence gathering is about collecting and analyzing information on external threats, not directly comparing host states. From a SOC standpoint, integrity monitoring supports rapid scoping and eradication because it highlights persistence and tampering mechanisms that must be removed and can reveal stealth modifications that evade signature scanners. It also supports compliance requirements by demonstrating configuration control and unauthorized-change detection capabilities.
Topics
Community Discussion
No community discussion yet for this question.