CS0-003 · Question #339
An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to…
The correct answer is D. Defense evasion. Defense evasion is the technique of avoiding detection or prevention by security tools or mechanisms. In this case, the freeware program is likely a malware that generates random DNS queries to communicate with a command and control server or exfiltrate data. The command Add…
Question
An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:
Add-MpPreference - ExclusionPath '%Program Files%\ksyconfig' Which of the following is possibly occurring?
Options
- APersistence
- BPrivilege escalation
- CCredential harvesting
- DDefense evasion
How the community answered
(27 responses)- A26% (7)
- B11% (3)
- C4% (1)
- D59% (16)
Explanation
Defense evasion is the technique of avoiding detection or prevention by security tools or mechanisms. In this case, the freeware program is likely a malware that generates random DNS queries to communicate with a command and control server or exfiltrate data. The command Add- MpPreference -ExclusionPath '%Program Filest\ksysconfig' is used to add an exclusion path to Windows Defender, which is a built-in antivirus software, to prevent it from scanning the
Topics
Community Discussion
No community discussion yet for this question.